How to set query memory usage for specific app?

[mahjp]

Hi everyone, this is my first time here.

I'm currently trying to set a limit that queries can use in my environment and i've successfully set a global config in limits.conf. But how can I make an exception to this config? Say I want to allow a single app to use more memory because it really needs it.
Where should I put this exception? Inside a limits.conf in app/default?

Couldn't find anything related to that on the doc for limits.conf

Many thanks in advance.

[richgalloway · Accepted solution]

Splunk's Workload Management feature may be able to help. It uses Linux cgroups to control how much resources searches can use.
See https://docs.splunk.com/Documentation/Splunk/8.0.3/Workloads/Aboutworkloadmanagement for more information.

[mahjp]

Great, thanks. I'll check it out.
But just to be sure, the limits.conf will not work if placed under app/default in my search heads?

[richgalloway]

limits.conf can be set in any app that is not disabled. Which setting are you changing?

[mahjp]

I'm trying to set something like this in an app.
"[search]
enable_memory_tracker = true
search_process_memory_usage_threshold = 1000"

in system/local I already have limits.conf set to:
"[search]
enable_memory_tracker = true
search_process_memory_usage_threshold = 100"

These values are for testing purposes. But when i try to search something from within the app itself, the memory limit still remains 100mb.

[richgalloway]

etc/system/local has highest priority for .conf files so it will override any setting in an app.
The memory tracker settings are global - not per-app. For granular control of resources use the Workload Management feature.