topic Re: Why does it take time to transfer a gz file? in Getting Data In

Why does it take time to transfer a gz file?

yutaka1005 — Tue, 21 Feb 2017 13:12:22 GMT

In my system architecture, UF is transfering 1.8GB GZ format Compressed ifilter log(original size is 15GB) to two IDX.
However, the transfer speed is very slow. In my calculation it will take around 24 hours to send all the logs.

The value of maxKbps is set to 0, So I am thinking that expand of the GZ file cause the matter.

But may such a matter occur?

Re: Why does it take time to transfer a gz file?

martin_mueller — Tue, 21 Feb 2017 14:59:32 GMT

UFs are capable of unpacking gzip at more than 20kb/s (1.8GB in 24h) - something else is going on.

Re: Why does it take time to transfer a gz file?

yutaka1005 — Thu, 23 Feb 2017 01:27:38 GMT

Thanks for your comments ! I overlooked that "maxKBps = 256" was set in "/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/limits.conf". When I changed the setting value, the transfer was successfully done.

Re: Why does it take time to transfer a gz file?

martin_mueller — Thu, 23 Feb 2017 08:01:51 GMT

Make sure you don't change limits.conf in etc/system/default, instead create one in etc/system/local or etc/apps/some_app/local - else all changes are lost on upgrade of Splunk.

Re: Why does it take time to transfer a gz file?

yutaka1005 — Thu, 02 Mar 2017 05:00:52 GMT

Thanks for your answer! I changed limits.conf in etc/system/local.