Splunk Search

limits.conf, non-global settings local to specific App

actionabledata
Path Finder

All, Hopefully a straightforward question.

Is it possible to increase the following setting in a .../appname/local/limits.conf such that the scope remains local and pertinent only to that appname and NOT global thus impacting other Apps and their searches?

FROM: max_mem_usage_mb = 200
TO:   max_mem_usage_mb = 2000

 We have an algorithm that must process a very large data ball before aggregating and reducing the data and we keep hitting this limit. We partition the data to get around the limit but I am hoping that this partitioning process can be eliminated.

Thank you

Labels (3)
0 Karma

Gene
Path Finder

Hello, it depends on where you want to put limits.conf file (e.g. app UniversalForwarder has this setting in opt/splunk/etc/apps/.../local, it's not the best practice and this could be disastrous and very poor form. You can try it on some test environment and provide your investigation results 🙂

 

Thanks, Gene

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...