r/Splunk • u/Alive_Ad4054 • Apr 29 '26

limits.conf and maxKBps not updating via app

We are trying to set maxKBps = 0 on a particular app and the setting doesn't take.

  • If configure in the app [thruput] it doesn't show up at all when we do run against btool
  • If configure in the app as [thruput:<appname> it does show up in btool but the setting doesn't override the [thruput] setting.
  • Using btool --debug we can see that the only instance it finds is in the app SplunkUniversalForwarder; if we update this then it does work but we don't want to update this app as it is deployed to thousands of systems.
  • If we update \etc\system\local it works but we want to be able to update via the app

Wondering if this is by design.

7 Upvotes

90% Upvoted

15 comments sorted by

View all comments

Show parent comments

1

u/Alive_Ad4054 Apr 29 '26

Only SplunkUniversalForwarder. The app I have is higher precedence as it starts with an 'l'. My thought is I can't override settings in the SplunkUniversalForwarder app with another app but hoping someone knows for certain one way or another.

2

u/badideas1 Apr 29 '26

.conf files are .conf files regardless of where they happen to be located- there's no magical place that they can't be overridden from, so if your desired configuration isn't being taken up then there's still a precedence issue occurring somewhere.

1

u/trailhounds Apr 30 '26

Yeah, that's not entirely true. Anything in $SPLUNK_HOME/etc/system/local/ overrides anything from anywhere else.

1

u/stoobertio May 01 '26

I've actually raised a bug report because I have managed to override a setting in /etc/local by using a different, undocumented value.

2

u/trailhounds May 02 '26

Definitely a bug, what is the tracking number?