https://community.splunk.com/t5/Getting-Data-In/splunktcpin-queue-full-what-is-the-impact/m-p/93717#M19484 <P>Hi</P> <P>In my splunk environment i have around 50-60 instances of splunktcpin queue blocked?<BR /> what is the impact on my data if splunktcpin queue is blocked? Would i be losing some data forwarded from my universal forwarder?</P> <P>WHen you say a queue is blocked, how long will the queue be blocked?</P> Mon, 15 Apr 2013 10:21:32 GMT adityapavan18 2013-04-15T10:21:32Z https://community.splunk.com/t5/Getting-Data-In/splunktcpin-queue-full-what-is-the-impact/m-p/93717#M19484 <P>Hi</P> <P>In my splunk environment i have around 50-60 instances of splunktcpin queue blocked?<BR /> what is the impact on my data if splunktcpin queue is blocked? Would i be losing some data forwarded from my universal forwarder?</P> <P>WHen you say a queue is blocked, how long will the queue be blocked?</P> Mon, 15 Apr 2013 10:21:32 GMT https://community.splunk.com/t5/Getting-Data-In/splunktcpin-queue-full-what-is-the-impact/m-p/93717#M19484 adityapavan18 2013-04-15T10:21:32Z https://community.splunk.com/t5/Getting-Data-In/splunktcpin-queue-full-what-is-the-impact/m-p/93718#M19485 <P>Hi adityapavan18,</P> <P>basically you can say that a queue is blocked until the congestion in the next queue is removed. <BR /> Most cases for blocked queues are either a temporary indexer overload, slow disks or forwarders sending too much data for what ever reason (some java log from a application gone crazy for example). </P> <P>You can limit the forwarder to not sent too much data at once in limits.conf:</P> <PRE><CODE>[thruput] maxKBps = &lt;integer&gt; * If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second. </CODE></PRE> <P>additionally you can <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Data/Usepersistentqueues">setup a persistent queue</A> on the forwarder to prevent data loss.<BR /><BR /> Regarding the Indexer, you can follow <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Installation/Performancechecklist">this checklist</A> about performance.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Wed, 20 Nov 2013 12:40:29 GMT https://community.splunk.com/t5/Getting-Data-In/splunktcpin-queue-full-what-is-the-impact/m-p/93718#M19485 MuS 2013-11-20T12:40:29Z