https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220216#M43243 <P>My limits.conf setting for my Heavy Forwarders is this - </P> <P>[root@LOCATIONp01SPLUNK303 default]# pwd<BR /> /opt/splunk/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/default<BR /> [root@LOCATIONp01SPLUNK303 default]# cat limits.conf<BR /> [thruput]<BR /> maxKBps = 0</P> Fri, 17 Jun 2016 22:03:47 GMT daniel333 2016-06-17T22:03:47Z https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220211#M43238 <P>All, </P> <P>I am looking at the queues on my heavy forwarder tier which I use to proxy all our Universal Forwarders. The queues are looking full lately, it seemed to creep up on us. Any recommendation on determining which config might be causing issues? </P> <P>thanks</P> Wed, 15 Jun 2016 21:38:03 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220211#M43238 daniel333 2016-06-15T21:38:03Z https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220212#M43239 <P>Check the limits.conf - maxKbps values might be limiting heavy forwarder's data transmissions to indexer and filling up the queue.</P> Thu, 16 Jun 2016 01:49:59 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220212#M43239 somesoni2 2016-06-16T01:49:59Z https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220213#M43240 <P>Hello Daniel, did you recently perform an upgrade?</P> Thu, 16 Jun 2016 02:18:34 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220213#M43240 phadnett_splunk 2016-06-16T02:18:34Z https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220214#M43241 <P>Which queues specifically are being blocked up? Depending on where the blocking is occurring will help determine what might be going on. Have you tried using the DMC to visualize the queues?</P> <P>If the index queue is being blocked on the Heavy Forwarder than yes the maxKbps setting may apply.</P> Thu, 16 Jun 2016 04:54:40 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220214#M43241 ryanoconnor 2016-06-16T04:54:40Z https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220215#M43242 <P>Yes we did. We moved from 6.3.3 to 6.4.1. </P> <P>It's just my heavy forwarders, very easy to move back to 6.3.3 if you think that would be a factor? </P> Fri, 17 Jun 2016 22:02:11 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220215#M43242 daniel333 2016-06-17T22:02:11Z https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220216#M43243 <P>My limits.conf setting for my Heavy Forwarders is this - </P> <P>[root@LOCATIONp01SPLUNK303 default]# pwd<BR /> /opt/splunk/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/default<BR /> [root@LOCATIONp01SPLUNK303 default]# cat limits.conf<BR /> [thruput]<BR /> maxKBps = 0</P> Fri, 17 Jun 2016 22:03:47 GMT https://community.splunk.com/t5/Getting-Data-In/Heavy-Forwarder-tier-queues-are-full-How-to-determine-which/m-p/220216#M43243 daniel333 2016-06-17T22:03:47Z