Splunk Search

Ulimit for open files did not match

khusain_splunk
Splunk Employee
Splunk Employee

Hi,

I have increased our ulimit for open file in our indexer to 65536 as recommended by splunk support. After the change, I checked the ulimit -n value in server and got the 65536 value as intended. However when I run health check using GUI, I got a warning saying that my ulimit for open file is still 4096.

Hence, I want to know if this a bug or is there something else that I am missing?

Tags (1)
0 Karma

woodcock
Esteemed Legend

The easiest way to ensure that Splunk has the ulimit setting that you need, is to enable boot-start and NOT use systemd. Then make sure that the top of /etc/init.d/splunk looks like this:

#!/bin/sh
#
# /etc/init.d/splunk
# init script for Splunk.
# generated by 'splunk enable boot-start'.
#
# chkconfig: 2345 90 60
# description: Splunk indexer service
#
RETVAL=0
USER="splunk"

. /etc/init.d/functions
ulimit -Hn 65536
ulimit -Sn 32768
ulimit -u 16384
0 Karma

khusain_splunk
Splunk Employee
Splunk Employee

Please check first which OS version you are running. If it is Redhat 7 then changes should be at systemd level.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/ulimitErrors#Set_limits_using_the...

Earlier, I believe you have made the changes as per the process mentioned for below 7 version.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...