https://community.splunk.com/t5/Getting-Data-In/How-can-I-identity-forwarder-data-rate-and-index-data-rate-to/m-p/290231#M55371 <P>For forwarder lag, start to look at the metrics.log on the forwarder, if you see that it is hitting a plateau of kbps speed, it may be that you are hitting the default thuput limit.<BR /> see this article<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits">http://docs.splunk.com/Documentation/Splunk/7.0.0/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits</A></P> <P>Also look at the timestamp, maybe is it a timezone issue.</P> Fri, 06 Oct 2017 19:20:17 GMT yannK 2017-10-06T19:20:17Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-identity-forwarder-data-rate-and-index-data-rate-to/m-p/290230#M55370 <P>Hi,<BR /> Is there any way where we can identify how much data the forwarder is sending and how much data is being indexed in real-time?<BR /> The problem is that I have a single forwarder that is sending data to a single indexer and its sending multiple logs i.e. 50 monitored files with different indexes. I am receiving data from a few indexes in real time whereas for some indexes I am having a lag, so I want to remove the lag and if possible give higher preferences to some logs file.</P> Fri, 06 Oct 2017 18:09:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-identity-forwarder-data-rate-and-index-data-rate-to/m-p/290230#M55370 chintan_shah 2017-10-06T18:09:14Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-identity-forwarder-data-rate-and-index-data-rate-to/m-p/290231#M55371 <P>For forwarder lag, start to look at the metrics.log on the forwarder, if you see that it is hitting a plateau of kbps speed, it may be that you are hitting the default thuput limit.<BR /> see this article<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits">http://docs.splunk.com/Documentation/Splunk/7.0.0/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits</A></P> <P>Also look at the timestamp, maybe is it a timezone issue.</P> Fri, 06 Oct 2017 19:20:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-identity-forwarder-data-rate-and-index-data-rate-to/m-p/290231#M55371 yannK 2017-10-06T19:20:17Z