topic Re: What is the maximum value for maxQueueSize that can be used in outputs.conf for Splunk version 6.6.0? in Getting Data In

What is the maximum value for maxQueueSize that can be used in outputs.conf for Splunk version 6.6.0?

nehabhuti — Wed, 20 Dec 2023 15:48:28 GMT

I'm migrating my Splunk Instance from an outdated OS. I want to increase the buffer size for my Splunk forwarder so that it can withstand all the logs when the receiver/ Indexer is down. We are using Splunk version 6.6.0, I'm unable to find relevant documentation for referring to the configuration file changes.

Re: What is the maximum value for maxQueueSize that can be used in outputs.conf for Splunk version 6.6.0?

richgalloway — Wed, 20 Dec 2023 16:34:36 GMT

That setting probably has not changed over the years since 6.6.0. The docs don't specify a maximum value so it may be limited only by the amount of memory available on your server.

Re: What is the maximum value for maxQueueSize that can be used in outputs.conf for Splunk version 6.6.0?

isoutamo — Wed, 20 Dec 2023 19:43:35 GMT

as @richgalloway said most of parameters are still in use. Just look version 7.0.0 to get the nearest docs. You found those settings at least server and inputs conf files. If/when you are talking about intermediate forwarders you should ensure that you are using also persistent disk queues and not only memory based. Otherwise you lost events if nodes or services goes down before indexers are up.

r. Ismo