All Apps and Add-ons

What is a safe level for Stream's maxTcpReassemblyPacketCount

joeldavideng
Path Finder

I have a couple of very high volume DNS servers that I am attempting to capture queries from using Splunk's Stream app. The Stream app fails within minutes of starting and throws an error stating the TCP reassembly queue has overflowed. Based on the fact that the Stream app works just fine on my low volume DNS servers and the content of the error message I believe I need to up the maxTcpReassemblyPacketCount. I checked out the documentation, which seems to define the default value, but I can't find a maximum value or anything stating what effect this will have on RAM usage. Does anyone know what the maximum value is and potentially a ratio of packets to RAM usage?

0 Karma

joeldavideng
Path Finder

In the absence of any guidance I just doubled the count to 1 million. I can't say this solved my problem, but it the agents didn't complain.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...