"HttpListener - Socket error from 127.0.0.1 ... Broken pipe" splunkd.log messages since upgrading to Splunk 6.1.5

[wrangler2x]

The full message is:

WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/-/search/admin/summarization: Broken pipe

It is always the same. I get five of them in a row, a second apart. I see them at 15, 30, 40 and 45 minutes after the hour.

I am on Splunk 6.1.5 build 239630

When splunk is starting up I see these:

12-09-2014 11:43:35.753 -0800 INFO  loader - Limiting REST HTTP server to 2730 sockets
12-09-2014 11:43:35.753 -0800 INFO  loader - Limiting REST HTTP server to 397 threads

$ ulimit -n
8192

I'm wondering what it was doing and what I need to do to stop the errors.

[mwong]

Hi,

Please check the ulimit -u , default value is more than 150k. Please change that, it should fix that.

[kiril123]

are you saying that 150k default value has to be changed? To what value?