https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-thruput-limit-and-what-queue-size-increases/m-p/135410#M27871 <P>Hi @robf</P> <P>According to this page from documentation:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits">http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits</A><BR /> the default thruput limit is 256KBps. As for the recommendations and negative impacts on queue size, I have no clue, so hopefully someone well versed in that area will come along and help you out. </P> Thu, 04 Jun 2015 17:58:08 GMT ppablo 2015-06-04T17:58:08Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-thruput-limit-and-what-queue-size-increases/m-p/135409#M27870 <P>What is the default for thruput as it's not specified?</P> <PRE><CODE>[thruput] maxKBps = &lt;integer&gt; If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second. To control the CPU load while indexing, use this to throttle the number of events this indexer processes to the rate (in KBps) you specify. </CODE></PRE> <P>What queue size increases are recommended for a busy Windows Universal Forwarder? Shat is the negative impact of having big queues?</P> Thu, 04 Jun 2015 10:17:33 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-thruput-limit-and-what-queue-size-increases/m-p/135409#M27870 robf 2015-06-04T10:17:33Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-thruput-limit-and-what-queue-size-increases/m-p/135410#M27871 <P>Hi @robf</P> <P>According to this page from documentation:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits">http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits</A><BR /> the default thruput limit is 256KBps. As for the recommendations and negative impacts on queue size, I have no clue, so hopefully someone well versed in that area will come along and help you out. </P> Thu, 04 Jun 2015 17:58:08 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-thruput-limit-and-what-queue-size-increases/m-p/135410#M27871 ppablo 2015-06-04T17:58:08Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-thruput-limit-and-what-queue-size-increases/m-p/135411#M27872 <P>Remark :<BR /> Please do not thing that increasing the queue size will resolve this issue permanently.</P> <P>You want to allow faster speed instead.</P> <P>256 KBps will allow the FWD to do up to 115Mb per hour.<BR /> <A href="https://www.google.com/search?btnG=1&amp;pws=0&amp;q=256+kbps+to+mb+per+hour&amp;gws_rd=ssl">https://www.google.com/search?btnG=1&amp;pws=0&amp;q=256+kbps+to+mb+per+hour&amp;gws_rd=ssl</A></P> <P>So if you are monitoring a very busy instance (like a windows DC), you have to bump or remove the limit.</P> <UL> <LI>you can work by increments. By example 1024KBps, then 2048Kbps etc... until you do not see a huge delay in the indexing of the events</LI> <LI>or remove the limit (maxKBps=0), and check the results in metrics.log.</LI> </UL> <P>If you have no idea of the actual average volume or delay, check this guide :<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/Troubleshootingeventsindexingdelay">http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/Troubleshootingeventsindexingdelay</A></P> Sun, 14 Jun 2015 03:44:20 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-default-thruput-limit-and-what-queue-size-increases/m-p/135411#M27872 yannK 2015-06-14T03:44:20Z