topic Re: How to schedule a transfer on a forwarder? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62693#M12528 <P>What do you mean? Configure what?</P> Mon, 01 Oct 2012 06:30:34 GMT Ayn 2012-10-01T06:30:34Z How to schedule a transfer on a forwarder? https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62689#M12524 <P>I create a forwarder on a remote site. The speed of network is limited. I need transfer the event log in middle-night on the forwarder. </P> <P>How can I configure the transfer start at middle-night, pause at six o'clock?</P> <P>Thank you in advance.</P> Tue, 18 Sep 2012 02:29:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62689#M12524 shizl 2012-09-18T02:29:55Z Re: How to schedule a transfer on a forwarder? https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62690#M12525 <P>collect and transfer cannot be scheduled then you will need to use a local cron job to stop &amp; start splunk.</P> Tue, 18 Sep 2012 05:35:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62690#M12525 MarioM 2012-09-18T05:35:34Z Re: How to schedule a transfer on a forwarder? https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62691#M12526 <P>How to configure the forwarder or indexer without stop splunk?</P> Thu, 27 Sep 2012 02:50:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62691#M12526 shizl 2012-09-27T02:50:50Z Re: How to schedule a transfer on a forwarder? https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62692#M12527 <P>How to configure the forwarder or indexer without stop splunk?</P> Thu, 27 Sep 2012 02:51:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62692#M12527 shizl 2012-09-27T02:51:35Z Re: How to schedule a transfer on a forwarder? https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62693#M12528 <P>What do you mean? Configure what?</P> Mon, 01 Oct 2012 06:30:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62693#M12528 Ayn 2012-10-01T06:30:34Z Re: How to schedule a transfer on a forwarder? https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62694#M12529 <P>@shizl, There are couple of ways to accomplish what your want or least come close, scripted input or oneshot. Please read my previous post. Hope this helps.</P> <P>If your network is limited you may also want to enable indexer achnowledgement to prevent data lost in-flight.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Protectagainstlossofin-flightdata">Protect against loss of in-flight data</A></P> <P><A href="http://splunk-base.splunk.com/answers/59916/can-you-set-a-certain-time-forwarding-occurs?page=1&amp;focusedAnswerId=59951#59951">Answers: Can you set a certain time forwarding occurs</A></P> Mon, 01 Oct 2012 17:03:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62694#M12529 bmacias84 2012-10-01T17:03:52Z Re: How to schedule a transfer on a forwarder? https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62695#M12530 <P>Create a batch script that reduce the thruput during day time, and unleash the beast at night.<BR /> I assume that you are on windows<BR /> create <CODE>%SPLUNK\_HOME%\etc\system\local\limits.conf_superslow</CODE><BR /> <CODE><BR /> [thruput]<BR /> maxKBps=50<BR /> # default was 256 <BR /> </CODE><BR /> and create <CODE>%SPLUNK\_HOME%\etc\system\local\limits.conf_superfast</CODE><BR /> <CODE><BR /> [thruput]<BR /> maxKBps=0<BR /> # for unlimited<BR /> </CODE></P> <P>Then at night time run a batch using the windows scheduler (running under the correct user of course)</P> <P><CODE>cp %SPLUNK_HOME%\etc\system\local\limits.conf_superfast %SPLUNK_HOME%\etc\system\local\limits.conf<BR /> %SPLUNK\_HOME%\bin\splunk restart<BR /> </CODE></P> <P>and in the morning</P> <P><CODE>cp %SPLUNK_HOME%\etc\system\local\limits.conf_superslow %SPLUNK_HOME%\etc\system\local\limits.conf<BR /> %SPLUNK_HOME%\bin\splunk restart<BR /> </CODE></P> Tue, 02 Oct 2012 15:03:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-schedule-a-transfer-on-a-forwarder/m-p/62695#M12530 yannK 2012-10-02T15:03:20Z