Splunk Search

Limits.conf window not acting on setting that UNIX is - is it a bug?

robertlynch2020
Motivator

HI

When I was developing the app I was testing on UNIX, these settings (below) worked very well and kept the number of jobs down (dispatch directory).
I have put the app on WINDOWS, however, they don’t seem to be working. When I run a btool I can see they are in the correct place (well I think they are please correct me).
Is there anything I should know from the development of an app from UNIX to Windows, please?

robertlynch2020_1-1683132425048.png

Tanks in advance

How do I know it is not working?

UNIX image we can see the number of jobs staying low, green box

robertlynch2020_0-1683132605409.png

windows image we can see the number is rising.

robertlynch2020_1-1683132634266.png

 

Rob

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. I'm not aware of any job limits working per app scope. So your resulting limits might be better checked without limiting to the single app.

2. Your settings don't show anything about job concurrency.

https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Limitsconf#Concurrency

3. Maybe - if your searches are spawned using particular user - you could set usage quotas for that user/role?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @robertlynch2020,

I suppose that you have similar resources on Windows and Linux, but Windows requires more resources than Linux, so probably this is the reason of the different behaviour.

But anyway, open a case to Splunk Support (sending them both the diags), it isn't possible to debug your situation from off-line.

Ciao.

Giuseppe

0 Karma

robertlynch2020
Motivator

HI @gcusello 

Thanks for the replay.

In fact, the Windows box has double the CPU as the Linux, but the issue is the number of jobs being created. I have created a dashboard that creates lots and lots of jobs, so I need a way to clean them up quickly.

I have noticed when the dispatch/search directory goes over ~10,000 the CPU starts to have major issues. This is why I put in the setting of keeping jobs for 40 seconds, and it works very well on UNIX.  Unless I have to put these settings somewhere else on Windows, or are there user role issues I wonder?

From the btool it looks very clear that it is set

additional information it's a Windows search head with Linux indexers (I did not set this, up and I am trying to get them to move to 100% unix). 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...