0

In Limits.conf fields is limited to 200 we want 500 fields extraction for specific index . Tried giving limits to sourcetype of the index but not working . If we give it in limits.conf it will effect every index leading to high storage use . Is there a way to change field extraction for specific index

warren
  • 32,620
  • 21
  • 85
  • 124
Akhil
  • 1
  • 4
  • What use case do you have where you think you need to change those default values? Per the [docs](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf), you'd be making system-wide (ie global) changes if you alter `limits.conf` (which may be what you want - but it doesn't sound like it). – warren Jul 14 '21 at 10:34
  • There is an user who wants Around 450 fields to be added to splunk . If we change in limits.conf then it is going to effect globally and is there a way to confine the limits to specific Index or sourcetype. FYI ours is cloud environment – Akhil Jul 14 '21 at 13:02
  • so far as *Splunk Cloud* is concerned, that's going to be a Splunk Support question. But the question's going to come down to *why* does this user think he needs to add about 450 fields to a given sourcetype? Unless you're looking at degenerate JSON ... that's a truly insane number of fields to keep track of – warren Jul 14 '21 at 14:33
  • Can the user extract the fields at search time rather than index time? – RichG Jul 14 '21 at 15:53
  • He provided that number to accomodate current and future field addition to equipment data. And sourcetype is Json What is degenerate JSON he wants the change in indexed_kv_limit – Akhil Jul 15 '21 at 10:42

1 Answers1

0

Changing limits.conf affects the entire system. There is no setting governing the number of fields each index can extract.

Changing limits.conf will not necessarily increase storage use as it will depend on the actual number of fields extracted.

RichG
  • 9,063
  • 2
  • 18
  • 29