https://community.splunk.com/t5/Getting-Data-In/Data-transfer-rate-between-forward-and-indexer/m-p/89595#M18591 <P>Is this a Universal Forwarder? UF's have a default data transfer rate capped at 256Kbps.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Introducingtheuniversalforwarder">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Introducingtheuniversalforwarder</A></P> Tue, 03 Jul 2012 21:30:46 GMT Ayn 2012-07-03T21:30:46Z https://community.splunk.com/t5/Getting-Data-In/Data-transfer-rate-between-forward-and-indexer/m-p/89593#M18589 <P>Has anybody experienced condition where Forwarder is not reading and sending old logs fast? Eventhough there's plenty of bandwidth between forwarder and Indexer?</P> <P>I have a feeling that Splunk forwarder is intentionally forwarding data at a low rate to reduce load on the network and the server when the data that's being indexed is old (not current) data.</P> <P>Does splunk intelligently rate data transfers and index speed based on age of the data?</P> Tue, 03 Jul 2012 16:57:46 GMT https://community.splunk.com/t5/Getting-Data-In/Data-transfer-rate-between-forward-and-indexer/m-p/89593#M18589 clyde772 2012-07-03T16:57:46Z https://community.splunk.com/t5/Getting-Data-In/Data-transfer-rate-between-forward-and-indexer/m-p/89594#M18590 <P>Maybe someone overrode the default setting in limits.conf?</P> <P><A href="http://splunk-base.splunk.com/answers/1810/store-and-forward-and-bandwidth-contraints">http://splunk-base.splunk.com/answers/1810/store-and-forward-and-bandwidth-contraints</A></P> <P>[thruput]</P> <P>maxKBps = <INTEGER><BR /> * If specified and not zero, this limits the speed through the thruput processor to the specified <BR /> rate in kilobytes per second.<BR /> * To control the CPU load while indexing, use this to throttle the number of events this indexer <BR /> processes to the rate (in KBps) you specify. </INTEGER></P> Tue, 03 Jul 2012 17:01:37 GMT https://community.splunk.com/t5/Getting-Data-In/Data-transfer-rate-between-forward-and-indexer/m-p/89594#M18590 sdaniels 2012-07-03T17:01:37Z https://community.splunk.com/t5/Getting-Data-In/Data-transfer-rate-between-forward-and-indexer/m-p/89595#M18591 <P>Is this a Universal Forwarder? UF's have a default data transfer rate capped at 256Kbps.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Introducingtheuniversalforwarder">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Introducingtheuniversalforwarder</A></P> Tue, 03 Jul 2012 21:30:46 GMT https://community.splunk.com/t5/Getting-Data-In/Data-transfer-rate-between-forward-and-indexer/m-p/89595#M18591 Ayn 2012-07-03T21:30:46Z