Splunk Search

limits.conf, non-global settings local to specific App

actionabledata
Path Finder

All, Hopefully a straightforward question.

Is it possible to increase the following setting in a .../appname/local/limits.conf such that the scope remains local and pertinent only to that appname and NOT global thus impacting other Apps and their searches?

FROM: max_mem_usage_mb = 200
TO:   max_mem_usage_mb = 2000

 We have an algorithm that must process a very large data ball before aggregating and reducing the data and we keep hitting this limit. We partition the data to get around the limit but I am hoping that this partitioning process can be eliminated.

Thank you

Labels (3)
0 Karma

Gene
Path Finder

Hello, it depends on where you want to put limits.conf file (e.g. app UniversalForwarder has this setting in opt/splunk/etc/apps/.../local, it's not the best practice and this could be disastrous and very poor form. You can try it on some test environment and provide your investigation results 🙂

 

Thanks, Gene

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...