I have a couple of very high volume DNS servers that I am attempting to capture queries from using Splunk's Stream app. The Stream app fails within minutes of starting and throws an error stating the TCP reassembly queue has overflowed. Based on the fact that the Stream app works just fine on my low volume DNS servers and the content of the error message I believe I need to up the maxTcpReassemblyPacketCount. I checked out the documentation, which seems to define the default value, but I can't find a maximum value or anything stating what effect this will have on RAM usage. Does anyone know what the maximum value is and potentially a ratio of packets to RAM usage?
In the absence of any guidance I just doubled the count to 1 million. I can't say this solved my problem, but it the agents didn't complain.