Splunk Enterprise

How to increase Ulimit on Linux for Splunk?

OgoSplunk
Path Finder

Hi,

I'm researching the Splunk Enterprise Environment and as of now I'm on "Architecture Optimization". I had a quick question for version 9.0.2 and that is how and what is the recommended Ulimit increase on Linux for optimization purposes?

Regards,

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Splunk documentation (which @richgalloway already pointed you to) lists minimal recommended values.

As with any resource-related question, without a precisely formulated requirements and circumstances there is no one good answer and usually "the more, the better".

You have to ask yourself what are the ulimits and what purpose they serve. They are limits that system enforces on a particular user and they are in place not to help a single process or user but rather to prevent one user from "overrunning" whole server and starving it out of resources. Therefore ulimits are usually set relatively low on servers with many concurrent users (like old-style unix servers in university departments on which many users work at the same time), they might have some use on your local laptop where you might have different services working with different user's accounts but don't make much sense in a single-purpose single-service server.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Splunk documentation (which @richgalloway already pointed you to) lists minimal recommended values.

As with any resource-related question, without a precisely formulated requirements and circumstances there is no one good answer and usually "the more, the better".

You have to ask yourself what are the ulimits and what purpose they serve. They are limits that system enforces on a particular user and they are in place not to help a single process or user but rather to prevent one user from "overrunning" whole server and starving it out of resources. Therefore ulimits are usually set relatively low on servers with many concurrent users (like old-style unix servers in university departments on which many users work at the same time), they might have some use on your local laptop where you might have different services working with different user's accounts but don't make much sense in a single-purpose single-service server.

richgalloway
SplunkTrust
SplunkTrust

See https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements#Considerations_r... for the recommended ulimit settings.

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...