I have a couple of very high volume DNS servers that I am attempting to capture queries from using Splunk's Stream app. The Stream app fails within minutes of starting and throws an error stating the TCP reassembly queue has overflowed. Based on the fact that the Stream app works just fine on my low volume DNS servers and the content of the error message I believe I need to up the maxTcpReassemblyPacketCount. I checked out the documentation, which seems to define the default value, but I can't find a maximum value or anything stating what effect this will have on RAM usage. Does anyone know what the maximum value is and potentially a ratio of packets to RAM usage?
