changing the value of the 'search_startup_config_timeout_ms' setting in "limits.conf"

[Akhanda]

Hi,

Unable to search the dataset Botsv3 in my splunk local machine it is throwing an error like 

Configuration initialization for C:\Program Files\Splunk\etc took longer than expected (16532ms) when dispatching a search with search ID 1751901306.48. This might indicate an issue with underlying storage performance or the knowledge bundle size. If you want this message displayed more or less often, change the value of the 'search_startup_config_timeout_ms' setting in "limits.conf" to a lower or higher number.

How to resolve this issue!

Thanks

[Akhanda]

Hi,

There is no limits.conf file in the $SPLUNK_HOME/etc/system/local/  directory !!

[livehybrid]

Hi @Akhanda 
That is fine, just create the file and then make sure the permissions allow for whichever user Splunk runs as. 
by default the local directory is empty (the defaults are in the “default” directory alongside the local directory so wouldn’t necessarily expect it to exist already. 
Regards

Will

[livehybrid]

Hi @Akhanda 

To change the search_startup_config_timeout_ms setting, edit the limits.conf file (e.g. in $SPLUNK_HOME/etc/system/local/limits.conf) and add or modify this setting under the [search] stanza. For example, to increase the timeout to 30000ms (30 seconds):

[search]
search_startup_config_timeout_ms = 30000

After saving the changes, restart Splunk for the new setting to take effect.

This setting controls how long (in milliseconds) Splunk waits for configuration initialization before timing out when starting a search. 

Only adjust this setting if you are sure storage performance is the cause, it sounds like this is the case here and I assume this is a local/dev instance with underlying performance issues.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing