Ulimit for open files did not match

[khusain_splunk]

Hi,

I have increased our ulimit for open file in our indexer to 65536 as recommended by splunk support. After the change, I checked the ulimit -n value in server and got the 65536 value as intended. However when I run health check using GUI, I got a warning saying that my ulimit for open file is still 4096.

Hence, I want to know if this a bug or is there something else that I am missing?

[woodcock]

The easiest way to ensure that Splunk has the ulimit setting that you need, is to enable boot-start and NOT use systemd. Then make sure that the top of /etc/init.d/splunk looks like this:

#!/bin/sh
#
# /etc/init.d/splunk
# init script for Splunk.
# generated by 'splunk enable boot-start'.
#
# chkconfig: 2345 90 60
# description: Splunk indexer service
#
RETVAL=0
USER="splunk"

. /etc/init.d/functions
ulimit -Hn 65536
ulimit -Sn 32768
ulimit -u 16384

[khusain_splunk]

Please check first which OS version you are running. If it is Redhat 7 then changes should be at systemd level.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/ulimitErrors#Set_limits_using_the...

Earlier, I believe you have made the changes as per the process mentioned for below 7 version.