topic Re: increasing maxKBPS for only one splunk forwarder host in Getting Data In

increasing maxKBPS for only one splunk forwarder host

kannu — Fri, 11 May 2018 10:31:17 GMT

Hi Splunkers ,

I am getting this splunkd log entry in only one splunk forwarder .

05-09-2018 08:11:39.579 +0000 INFO ThruputProcessor - Current data throughput (258 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

Please let me know how to solve this only for particular splunk forwarder . For doing only for one splunk forwarder can i mention the below entry in splunk forwarder for which i want or do i need to mention that in indexer (but how to mention that in indexer only for one splunk forwarder host not for all)

[thruput]
# means unlimited
maxKBps = 0

Re: increasing maxKBPS for only one splunk forwarder host

ddrillic — Fri, 11 May 2018 12:56:52 GMT

Please be careful with opening it up. The forwarder might not be stable. You probably should check first the indexing latency for the past week or so, and determine if you truly have a problem...

Re: increasing maxKBPS for only one splunk forwarder host

FrankVl — Fri, 11 May 2018 13:23:58 GMT

You configure that limit in the limits.conf on the respective forwarder, not the indexer.

Re: increasing maxKBPS for only one splunk forwarder host

xpac — Sat, 12 May 2018 13:53:10 GMT

This is also only a problem if it happens constantly. If you only have it happen a few times, it might just be fluctuation in data input.

Re: increasing maxKBPS for only one splunk forwarder host

cpetterborg — Sun, 13 May 2018 00:07:20 GMT

If you only want it on ONE forwarder, be sure to put it in a local/limits.conf file, to have the deployment server send the configuration to only the forwarder that you want.