Manage limits.conf configurations in Splunk Cloud Platform (2025)

The Admin Config Service (ACS) API supports self-service management of limits.conf configurations, which is useful for optimizing search performance on your Splunk Cloud Platform deployment. You can use the ACS API to edit, view, and reset select limits.conf settings programmatically, without assistance from Splunk Support.

You can also configure select limits.conf settings using the Splunk Web UI. For more information, see Configure limits in the Splunk Cloud Platform Admin Manual.

Requirements

To manage limits.conf configurations using the ACS API:

  • Your role must have the capabilities required to access the ACS API endpoint. The sc_admin role has all required capabilities by default. For a list of required capabilities, see Manage ACS API access with capabilities.
  • You must have Splunk Cloud Platform version 8.2.2203 or higher.
  • Your Splunk Cloud Platform deployment must be on Victoria Experience. See Determine your Splunk Cloud Platform Experience.
  • Your deployment must have one or more separate search heads or a search head cluster. ACS is not supported on single instance deployments.

Changing limits.conf settings can affect the performance of your Splunk Cloud Platform deployment.

Set up the ACS API

Before using the ACS API, you must download the ACS Open API 3.0 specification, which includes the parameters, codes, and other data you need to work with the ACS API. You must also create a JWT authentication token in Splunk Cloud Platform for use with ACS endpoint requests. For details on how to set up the ACS API for app management, see Set up the ACS API.

Manage limits.conf configurations using the ACS API

This section shows you how to view, edit, and reset select limits.conf settings using the ACS API.

The following table shows editable limits.conf settings by stanza, with minimum, maximum, and default values:

StanzaSettingDescriptionValues (min/max/default)
[join]subsearch_maxoutThe maximum number of result rows to output from subsearch to join against."minValue": 0

"maxValue": 100000
"defaultValue": 50000

subsearch_maxtimeMaximum search time, in seconds, before auto-finalization of subsearch."minValue": 0

"maxValue": 120
"defaultValue": 60

[kv]maxcharsTruncate _raw to this size and then do auto KV."minValue": 1

"maxValue": 20480
"defaultValue": 10240

limitThe maximum number of fields that an automatic key-value field extraction (auto kv) can generate at search time."minValue": 1

"maxValue": 200
"defaultValue": 100

maxcolsWhen non-zero, the point at which kv stops creating new fields."minValue": 256

"maxValue": 2048
"defaultValue": 512

[pdf]max_rows_per_tableThe maximum number of rows that will be rendered for a table within integrated PDF rendering."minValue": 500

"maxValue": 5000
"defaultValue": 1000

[scheduler]max_per_result_alertsMaximum number of alerts to trigger for each saved search instance (or real-time results preview for RT alerts). Only applies in non-digest mode alerting."minValue": 250

"maxValue": 5000
"defaultValue": 500

max_per_result_alerts_timeMaximum amount of time, in seconds, to spend triggering alerts for each saved search instance (or real-time results preview for RT alerts). Only applies in non-digest mode alerting."minValue": 150

"maxValue": 1800
"defaultValue": 300

[searchresults]maxresultrowsMaximum number of events generated by search commands"minValue": 0

"maxValue": 1000000
"defaultValue": 50000

[spath]extraction_cutoffFor 'extract-all' spath extraction mode, this setting applies extraction only to the first <integer> number of bytes. This setting applies both the auto kv extraction and the spath command, when explicitly extracting fields."minValue": 2500

"maxValue": 2000000
"defaultValue": 5000

[subsearch]maxoutMaximum number of results to return from a subsearch."minValue": 0

"maxValue": 10400
"defaultValue": 10000

maxtimeMaximum number of seconds to run a subsearch before finalizing"minValue": 0

"maxValue": 120
"defaultValue": 60

All editable limits.conf settings are reloadable.

For more information on limits.conf settings, see limits.conf in the Splunk Enterprise Admin Manual.

View all limits.conf settings

To list the current configuration of all editable limits.conf settings, send an HTTP GET request to the limits endpoint. For example:

curl -X GET https://admin.splunk.com/{stack}/adminconfig/v2/limits \-H "Authorization: Bearer <token>"

The request returns a list of all editable limits.conf stanzas and their corresponding values. For example:

[{"Stanza":"join","Values":{"subsearch_maxout":"91519","subsearch_maxtime":"111","subsearch_timeout":"120"}},{"Stanza":"kv","Values":{"limit":"100","maxchars":"182"}},{"Stanza":"subsearch","Values":{"maxout":"10000","maxtime":"60"}}]

For endpoint details, see limits in the ACS endpoint reference.

Edit limits.conf settings

To edit limits.conf settings, send an HTTP POST request to the limits/{stanza} endpoint, specifying the name of the limits.conf stanza in the request URL, and the setting name and updated value in the request body. For example:

curl --location --request POST 'https://admin.splunk.com/{stack}/adminconfig/v2/limits/join' \--header 'Authorization: Bearer <token>' \--header 'Content-Type: application/json' \--data-raw '{"settings": {"subsearch_maxout": 91519,"subsearch_maxtime": 111}}'

A successful request returns the settings and their updated values, with 202 status code, indicating the request was accepted, but the configuration update is still in progress due to the asynchronous ACS API. For example:

{"settings":{"subsearch_maxout":91519,"subsearch_maxtime":111}}

To confirm that your limits.conf update is complete, send an HTTP GET request to the limits/{stanza} endpoint, until the updated settings values appear in the output. See View a specific limits.conf stanza.

Invalid request responses

If your request contains a non-existent or uneditable stanza or setting, ACS returns an invalid response. For example:

{"code":"403-forbidden","message":"not allowed to access setting <invalid stanza>"}

If your request contains out-of-bounds setting value, ACS returns an invalid response. For example:

{"code":"403-forbidden","message":"request value 11111111111111.000000 outside of bounds min: 0.000000, max: 120.000000"}

If your request contains a non-integer setting value, ACS returns an invalid response. For example:

{"code":"403-forbidden","message":"Values provided must be positive integers"}

For endpoint details, see limits/{stanza} in the ACS endpoint reference.

View a specific limits.conf stanza

To view the current configuration of a specific limits.conf stanza, send an HTTP GET request to the limits/{stanza} endpoint, specifying the name of the stanza. For example:

curl -X GET https://admin.splunk.com/{stack}/adminconfig/v2/limits/join \-H "Authorization: Bearer <token>"

The request returns a list of all editable settings and their values in the stanza. For example:

{"subsearch_maxout":"91519","subsearch_maxtime":"111", "subsearch_timeout":"120"}

The GET request for a specific stanza returns only editable settings in that stanza.

For endpoint details, see limits/{stanza} in the ACS endpoint reference.

View a specific limits.conf setting

To view the configuration of a specific limits.conf setting under a specific stanza, send an HTTP GET request to the limits/{stanza}/{setting} endpoint, specifying the name of the stanza and the setting. For example:

curl -X GET https://admin.splunk.com/{stack}/adminconfig/v2/limits/join/subsearch_maxout \-H "Authorization: Bearer <token>"

The request returns the specified setting and its current value. For example:

{"subsearch_maxout":"91519"}

For endpoint details, see limits/{stanza}/{setting} in the ACS endpoint reference.

View default values for settings in all stanzas

To view all supported stanzas along with with default values for each setting within the stanza, send an HTTP GET request to the /limits/defaults endpoint. For example:

curl -X GET https://admin.splunk.com/{stack}/adminconfig/v2/limits/defaults \-H "Authorization: Bearer <token>"

The request returns a list of all supported stanzas along with the default value for each setting within the stanza:

[{"stanza": "join","settings": [{"setting": "subsearch_maxout","minValue": 0,"maxValue": 100000,"defaultValue": 50000},{"setting": "subsearch_maxtime","minValue": 0,"maxValue": 120,"defaultValue": 60},{"setting": "subsearch_timeout","minValue": 0,"maxValue": 240,"defaultValue": 120}]}, ...]

For endpoint details, see limits/defaults in the ACS endpoint reference.

View default values for settings in a specific stanza

To view default values for settings within a specific stanza, send an HTTP GET request to the /limits/{stanza}/defaults endpoint. For example:

curl -X GET https://admin.splunk.com/{stack}/adminconfig/v2/limits/subsearch/defaults \-H "Authorization: Bearer <token>"

The request returns a list of default values for settings with the specified stanza. For example:

{"stanza": "subsearch","settings": [{"setting": "maxout","minValue": 0,"maxValue": 10400,"defaultValue": 10000},{"setting": "maxtime","minValue": 0,"maxValue": 120,"defaultValue": 60}]}

For endpoint details, see limits/{stanza}/defaults in the ACS endpoint reference.

Restore default values for all limits.conf settings under a specific stanza

To restore the default values for all editable limits.conf settings under a specific stanza, send an HTTP POST request to the limits/{stanza}/reset endpoint, specifying the name of the stanza in the request URL. For example:

curl --location --request POST 'https://admin.splunk.com/{stack}/adminconfig/v2/limits/join/reset' \--header 'Authorization: Bearer <token>'

A successful request returns all editable settings in the stanza, with their default values restored. For example:

{"settings":{"subsearch_maxout":50000,"subsearch_maxtime":60,"subsearch_timeout":120}}

If your request contains an invalid or uneditable stanza, ACS returns a "not allowed to access stanza" message. For example:

{"code":"403-forbidden","message":"not allowed to access stanza <invalid stanza>"}

For endpoint details, see limits/{stanza}/reset in the ACS endpoint reference.

Restore default values for specific limits.conf settings under a specific stanza

To restore default values for a specific set of editable limits.conf settings under a specific stanza, send an HTTP POST request to the limits/{stanza}/reset endpoint, specifying the name of the stanza in the request URL, and the names of the settings in the request body. For example:

curl --location --request POST 'https://admin.splunk.com/{stack}/adminconfig/v2/limits/join/reset' \--header 'Authorization: Bearer <token>' \--header 'Content-Type: application/json' \--data-raw '{ "settings": [ "subsearch_maxout", "subsearch_timeout" ]}'

A successful request returns the specific settings in the stanza, with their default values restored. For example:

{"settings":{"subsearch_maxout":50000,"subsearch_timeout":120}}

If your request contains one or more uneditable or invalid settings, ACS returns a "not allowed to access setting" message. For example:

{"code":"403-forbidden","message":"not allowed to access setting <invalid settings>"}

If even a single specified setting is invalid, ACS will reject the request.

For endpoint details, see limits/{stanza}/reset in the ACS endpoint reference.

Manage limits.conf configurations in Splunk Cloud Platform (2025)

FAQs

What is concurrency limit in Splunk cloud? ›

Once on a search cluster which requires a minimum of 3 nodes, you should be able to run 3 x (38) or a total of 114 concurrent searches. By default Splunk cloud max_searches_perc will only let the scheduler use up to half of the 38 searches (19).

What is the limit of Splunk cloud? ›

Splunk Enterprise service limits
Service LimitBest Practice
Number of primary buckets in the clusterMax: 40,000,000 Recommended: 25,000,000
Number of concurrent usersMax: 2000 Recommended: 500
Number of peers in a non-clustered distributed search environmentMax: 1000 with bestEffortSearch Recommended: 500
3 more rows
Mar 30, 2024

What is the system limit for Splunk? ›

Charts, detectors, and SignalFlow limits
Limit nameDefault limit value
Maximum number of query arguments in a filter() function256
Maximum number of wildcards per filter() function35
Maximum SignalFlow program stack size64
Maximum SignalFlow program text size50,000
17 more rows
Aug 14, 2024

Where do I configure my Splunk settings? ›

Edit configuration files

Most of Splunk's configuration information is stored in . conf files. These files are located under your Splunk installation directory (usually referred to in the documentation as $SPLUNK_HOME ) under /etc/system .

How do you increase concurrency limit? ›

Open a quota increase case in the Service Quotas dashboard
  1. Open the Service Quotas dashboard.
  2. Choose the AWS Lambda card. The Lambda Service quotas page opens.
  3. Choose Concurrent executions.
  4. In the Recent quota increase requests pane, choose the Request quota increase button.
  5. Enter your requested concurrency limit.

What is the concurrency limit for cloud functions? ›

The maximum concurrency value is 1000 (though we recommend starting with a lower value and working your way up). Setting a concurrency value greater than 1 requires a function to have 1 or more vCPUs - see Memory limits for the default memory and vCPU values.

What is the 50000 limit in Splunk? ›

The limit you're talking about is the one where, if your base search is just returning raw event rows, Splunk only keeps 50,000 events in the search result. This means that later when you run your postprocess there can be misleading results.

What is the 10000 limit in Splunk? ›

It defaults to 10K but you can unlimit it by using sort 0 . Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it. Are you using sort ?

What is size limit exceeded in Splunk? ›

Size Limit Exceeded is an LDAP server error indicating that the search request was unable to return all entries due to a limit. The problem encountered is that the users or groups you are looking for may have been in the 1001+ entries and are not being returned. In AD, the default size limit is typically 1000 entries.

How do I set limits in Splunk? ›

In Splunk Web, click Settings > Server settings > Search preferences. Specify an option for Default search time range. In Relative concurrency limits for scheduled searches, select a percentage value for the concurrency limit for scheduled searches. This includes user-scheduled searches and summarization searches.

What is server.conf in Splunk? ›

The server. conf file is a key configuration file in a distributed Splunk Enterprise deployment in that it controls what functional role each node will play in the solution, and how these nodes communicate with each other.

What is the size limit for log entry in Splunk? ›

It depends on how the data is sent to Splunk. If it comes in via HEC then the limit is 1 million bytes (not characters) and cannot be changed. If the data comes in via port 9997 then it does not have the same limit, but will be truncated at 10,000 bytes.

How to check Splunk configuration? ›

Check your app with btool
  1. From the $SPLUNK_HOME/bin directory, run btool check. On Mac or Linux, enter this command: Bash. ./splunk btool --debug check. ...
  2. The btool check returns a list of conf files. The specific output differs depending upon what you have installed, but it includes savedsearches. conf and ui-prefs.

Where is Splunk configuration? ›

configuration file

Also referred to as a . conf file, configuration files are stored in the following locations: Default files: $SPLUNK_HOME/etc/system/default. Local files: $SPLUNK_HOME/etc/system/local.

What are some of the most important configuration files in Splunk? ›

List of Splunk Configuration Files
Configuration filePurpose
app.confConfigure app properties
authentication.confToggle between Splunk's built-in authentication or LDAP, and configures LDAP
authorize.confConfigure roles, including granular access controls.
collections.confConfigure KV Store collections for apps.
15 more rows
Mar 21, 2023

What is concurrency limiting? ›

The limit-concurrency policy prevents enclosed policies from executing by more than the specified number of requests at any time. When that number is exceeded, new requests will fail immediately with the 429 Too Many Requests status code.

What does max concurrency mean? ›

When more instances are processing requests, more CPU and memory will be used, resulting in higher costs. To give you more control, Cloud Run provides a maximum concurrent requests per instance setting that specifies the maximum number of requests that can be processed simultaneously by a given instance.

What is the limit of user level concurrent search jobs in Splunk? ›

As you have 2 CPU cores only, you can maximum run 8 searches concurrently based on default settings. Due to resource limitation splunk will not hit User-level concurrent search jobs limit which is 10 in your case.

What is the relative concurrency limit for scheduled searches in Splunk? ›

In Splunk Cloud Platform, this concurrent limit is configured for you. Note the following defaults: 50% of your concurrent searches are scheduled searches. 25% of your concurrent searches are summarization searches.

Top Articles
Latest Posts
Recommended Articles
Article information

Author: Nathanael Baumbach

Last Updated:

Views: 6626

Rating: 4.4 / 5 (75 voted)

Reviews: 82% of readers found this page helpful

Author information

Name: Nathanael Baumbach

Birthday: 1998-12-02

Address: Apt. 829 751 Glover View, West Orlando, IN 22436

Phone: +901025288581

Job: Internal IT Coordinator

Hobby: Gunsmithing, Motor sports, Flying, Skiing, Hooping, Lego building, Ice skating

Introduction: My name is Nathanael Baumbach, I am a fantastic, nice, victorious, brave, healthy, cute, glorious person who loves writing and wants to share my knowledge and understanding with you.