Deployment Architecture

Too many open files

khyoung7410
Communicator

Hi


Too many open files error message in my indexer.


so, ulimit(file opens) values change to 4,096(soft and hard).


However, the error message still occurs.


How are you?


Thank you.

Tags (2)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Hello,

Chances are high that you need to increase this number again. With 4.3 and the introduction of bloom filters, it's important to understand that the number of open files used could be increased significantly. I would suggest starting with 8192.

http://blogs.splunk.com/2011/11/21/whats-your-ulimit/

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

Hello,

Chances are high that you need to increase this number again. With 4.3 and the introduction of bloom filters, it's important to understand that the number of open files used could be increased significantly. I would suggest starting with 8192.

http://blogs.splunk.com/2011/11/21/whats-your-ulimit/

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...