Getting Data In

How high can we safely set max_fd in limits.conf on the forwarder?

ddrillic
Ultra Champion

We have large number of log files to ingest and the machine shows -

$ ulimit -n
64000

How high can we set the max_fd in limits.conf of the forwarder?

[inputproc]
max_fd = <8192 ???>
0 Karma
1 Solution

Claw
Splunk Employee
Splunk Employee

Claw
Splunk Employee
Splunk Employee

This has been answered in this blog.

http://blogs.splunk.com/2011/11/21/whats-your-ulimit/

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...