The hard fd limit is lower than the recommended value

The hard fd limit is lower than the recommended value.
The hard limit is ‘4096‘ The recommended value is ‘64000‘.

1. Go to your Search Head OR Indexer and open a GUI :
2.  Go to “Searching and Reporting” Application from the “Apps” Menu on the top left
3. Give the following Splunk Query on the Search Box :
 
index=_internal (transparent always)
OR recommended sourcetype=splunkd
| stats count by message, host
If the output comes as :
The hard fd limit is lower than the recommended value. 
The hard limit is ‘4096’ The recommended value is ‘64000’.
 
Remedy :
  
1. Go to box ( Search Head ) OR ( Indexer ) as 
 
   ssh OR
 
2.  ulimit -n 64000
 
3.  vi /etc/security/limits.conf
 
    # Add the below two lines in the file “limits.conf” 
 
    root          soft   nofile         64000
    root          hard   nofile         64000
 
 
4.  ulimit -Hn
 
    # Output should be ‘64000‘ 
 
 
Note : Hope whenever you encounter :
 
 
The hard fd limit is lower than the recommended value. 
The hard limit is ‘4096’ The recommended value is ‘64000’.
 
 
the above error, you will be able to solve it immediately!
Happy Splunking !!!
 
 
 
Advertisements
You can also know about :  In handler 'users': Could not get info for role that does not exist: winfra-admin

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.