Splunk Search

limits.conf, non-global settings local to specific App

actionabledata
Path Finder

All, Hopefully a straightforward question.

Is it possible to increase the following setting in a .../appname/local/limits.conf such that the scope remains local and pertinent only to that appname and NOT global thus impacting other Apps and their searches?

FROM: max_mem_usage_mb = 200
TO:   max_mem_usage_mb = 2000

 We have an algorithm that must process a very large data ball before aggregating and reducing the data and we keep hitting this limit. We partition the data to get around the limit but I am hoping that this partitioning process can be eliminated.

Thank you

Labels (3)
0 Karma

Gene
Path Finder

Hello, it depends on where you want to put limits.conf file (e.g. app UniversalForwarder has this setting in opt/splunk/etc/apps/.../local, it's not the best practice and this could be disastrous and very poor form. You can try it on some test environment and provide your investigation results 🙂

 

Thanks, Gene

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...