I need a way to determine how many files a particular user has open at any given time. This data exists in the output of the lsof data in the *nix app. BUt since it's one big field, I am unsure of how to parse it to get counts of files by user. Any ideas?
what is the maximum ulimit is splunk, by default minimum is 64000. anyone please let me know the maximum ulimit setting?
Did you try:
index=os sourcetype=lsof | multikv
Nice! Sometimes the simplest solution evades me. Thanks!