Splunk Search

Limits.conf window not acting on setting that UNIX is - is it a bug?

robertlynch2020
Influencer

HI

When I was developing the app I was testing on UNIX, these settings (below) worked very well and kept the number of jobs down (dispatch directory).
I have put the app on WINDOWS, however, they don’t seem to be working. When I run a btool I can see they are in the correct place (well I think they are please correct me).
Is there anything I should know from the development of an app from UNIX to Windows, please?

robertlynch2020_1-1683132425048.png

Tanks in advance

How do I know it is not working?

UNIX image we can see the number of jobs staying low, green box

robertlynch2020_0-1683132605409.png

windows image we can see the number is rising.

robertlynch2020_1-1683132634266.png

 

Rob

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. I'm not aware of any job limits working per app scope. So your resulting limits might be better checked without limiting to the single app.

2. Your settings don't show anything about job concurrency.

https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Limitsconf#Concurrency

3. Maybe - if your searches are spawned using particular user - you could set usage quotas for that user/role?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @robertlynch2020,

I suppose that you have similar resources on Windows and Linux, but Windows requires more resources than Linux, so probably this is the reason of the different behaviour.

But anyway, open a case to Splunk Support (sending them both the diags), it isn't possible to debug your situation from off-line.

Ciao.

Giuseppe

0 Karma

robertlynch2020
Influencer

HI @gcusello 

Thanks for the replay.

In fact, the Windows box has double the CPU as the Linux, but the issue is the number of jobs being created. I have created a dashboard that creates lots and lots of jobs, so I need a way to clean them up quickly.

I have noticed when the dispatch/search directory goes over ~10,000 the CPU starts to have major issues. This is why I put in the setting of keeping jobs for 40 seconds, and it works very well on UNIX.  Unless I have to put these settings somewhere else on Windows, or are there user role issues I wonder?

From the btool it looks very clear that it is set

additional information it's a Windows search head with Linux indexers (I did not set this, up and I am trying to get them to move to 100% unix). 

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...