Splunk Search

Finding the host for which the REST thread limit reached

kteng2024
Path Finder

Hi,

I could see the following warning :

" Can't handle request max thread limit for REST HTTP server"

Is there any way that we could know because of which hosts or queries we are getting this warning ?

0 Karma

Masa
Splunk Employee
Splunk Employee

First, I would check the thread limit.
http://docs.splunk.com/Documentation/Splunk/6.5.3/Troubleshooting/HTTPthreadlimitissues

Then, the number is high enough, and the issue persists, I would recommend to contact Splunk Support for further investigation.
Splunk Support will probably ask to collect diag, ps or top output with thread option, and pstack so that Splunk engineer will be able to look into thread stacks.

0 Karma

kteng2024
Path Finder

Thank you .. Is there any way that we could know which hosts are responsible for this warning ?

0 Karma

Masa
Splunk Employee
Splunk Employee

In splunkd.log, you can find a log. The host of the splunkd.log is using up threads limit.

Here is an example;
02-04-2016 12:11:08.983 -0800 WARN HttpListener - Can't handle request for $REST_request_here$, max thread limit for REST HTTP server is 1000, threads already in use is 1001

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Do you want to provide a bit more detail as to what exactly you are doing? Who is calling what via REST etc.
Without knowing a bit more about your setup, it'll be hard to help, I suspect.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...