Splunk Enterprise

How to set query memory usage for specific app?

Engager

Hi everyone, this is my first time here.

I'm currently trying to set a limit that queries can use in my environment and i've successfully set a global config in limits.conf. But how can I make an exception to this config? Say I want to allow a single app to use more memory because it really needs it.
Where should I put this exception? Inside a limits.conf in app/default?

Couldn't find anything related to that on the doc for limits.conf

Many thanks in advance.

Labels (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Splunk's Workload Management feature may be able to help. It uses Linux cgroups to control how much resources searches can use.
See https://docs.splunk.com/Documentation/Splunk/8.0.3/Workloads/Aboutworkloadmanagement for more information.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Splunk's Workload Management feature may be able to help. It uses Linux cgroups to control how much resources searches can use.
See https://docs.splunk.com/Documentation/Splunk/8.0.3/Workloads/Aboutworkloadmanagement for more information.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Engager

Great, thanks. I'll check it out.
But just to be sure, the limits.conf will not work if placed under app/default in my search heads?

0 Karma

SplunkTrust
SplunkTrust

limits.conf can be set in any app that is not disabled. Which setting are you changing?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Engager

I'm trying to set something like this in an app.
"[search]
enable_memory_tracker = true
search_process_memory_usage_threshold = 1000"

in system/local I already have limits.conf set to:
"[search]
enable_memory_tracker = true
search_process_memory_usage_threshold = 100"

These values are for testing purposes. But when i try to search something from within the app itself, the memory limit still remains 100mb.

0 Karma

SplunkTrust
SplunkTrust

etc/system/local has highest priority for .conf files so it will override any setting in an app.
The memory tracker settings are global - not per-app. For granular control of resources use the Workload Management feature.

---
If this reply helps you, an upvote would be appreciated.
0 Karma