topic Re: Throttle speed when Splunk Forwarder starts up? in Getting Data In

Throttle speed when Splunk Forwarder starts up?

Dark_Ichigo — Wed, 27 Feb 2013 02:16:15 GMT

When starting up the Splunk forwarder, I have noticed that there is a CPU spike that hits, but this is only when at start-up, my question is, is there any network throttling capability that Splunk uses to prevent a large CPU spike at start up?, or is this something I really shouldn't worry about?

I'm not sure if the CPU spike is related to network activity during splunk start-up, Im not too sure if the Splunk Forwarder increases network activity when it first starts up and then gradually decreases when start-up is complete?, or is this when it first when it establishes a connection with the Splunk index server?

Re: Throttle speed when Splunk Forwarder starts up?

yannK — Wed, 27 Feb 2013 07:02:55 GMT

The universal and lightweight forwarder have a network threshold of 256KBps (see thruput in limits.conf).

You can observe a network spike at the start but it stabilized after a minute.
But the Cpu spike may also be the scan of all the monitored files to check the modifications.

Re: Throttle speed when Splunk Forwarder starts up?

Dark_Ichigo — Wed, 27 Feb 2013 07:43:21 GMT

Thanks, funny thing is that its currently set to 0 in limits.conf, If this will indeed limit how much can be forwarded over the network at once, then my work here is done 🙂