Is it possible to increase the following setting in a .../appname/local/limits.conf such that the scope remains local and pertinent only to that appname and NOT global thus impacting other Apps and their searches?
FROM: max_mem_usage_mb = 200
TO: max_mem_usage_mb = 2000
We have an algorithm that must process a very large data ball before aggregating and reducing the data and we keep hitting this limit. We partition the data to get around the limit but I am hoping that this partitioning process can be eliminated.
Hello, it depends on where you want to put limits.conf file (e.g. app UniversalForwarder has this setting in opt/splunk/etc/apps/.../local, it's not the best practice and this could be disastrous and very poor form. You can try it on some test environment and provide your investigation results 🙂