topic Re: How to limit heavy forwarder bandwidth in limits.conf? in Getting Data In

How to limit heavy forwarder bandwidth in limits.conf?

splunkreal — Sun, 07 Jun 2020 01:28:25 GMT

Hello guys,

is it possible to limit Heavy forwarders bandwidth like UF (setting [thruput] in limits.conf for forwarders)?

Thanks.

Re: How to limit heavy forwarder bandwidth in limits.conf?

gcusello — Mon, 25 May 2020 14:22:04 GMT

Hi @realsplunk,
yes it's the same thing, only one hint beware to the traffic to avoid that your HF will be the bottle neck of your network.

Ciao.
Giuseppe

Re: How to limit heavy forwarder bandwidth in limits.conf?

splunkreal — Mon, 25 May 2020 15:10:04 GMT

Hi Cusello,
we have +800 KB/s indexing Checkpoint through OPSEC app and other syslogs through tcp/udp basically.

Here are the confs :

[root@HFSIEM01 ~]# grep -r -i maxKBps /OPT/siem/splunk/etc
/OPT/siem/splunk/etc/system/README/server.conf.spec:    1. maxKBps (in limits.conf)
/OPT/siem/splunk/etc/system/README/limits.conf.spec:maxKBps = <integer>
/OPT/siem/splunk/etc/system/README/limits.conf.spec:  * The thruput processor applies the 'maxKBps' setting for each
/OPT/siem/splunk/etc/system/README/limits.conf.spec:    pipelines, the processor multiplies the 'maxKBps' value

/OPT/siem/splunk/etc/system/default/limits.conf:maxKBps = 0
/OPT/siem/splunk/etc/apps/SplunkLightForwarder/default/limits.conf:maxKBps = 256

If I understand conf file precedence and if it applied, the limit should be 256?

Thanks.

Re: How to limit heavy forwarder bandwidth in limits.conf?

splunkreal — Tue, 26 May 2020 14:26:03 GMT

From support : "Splunk Heavy Forwarder does not have setting to limit network bandwidth."