All Apps and Add-ons

What is a safe level for Stream's maxTcpReassemblyPacketCount

joeldavideng
Path Finder

I have a couple of very high volume DNS servers that I am attempting to capture queries from using Splunk's Stream app. The Stream app fails within minutes of starting and throws an error stating the TCP reassembly queue has overflowed. Based on the fact that the Stream app works just fine on my low volume DNS servers and the content of the error message I believe I need to up the maxTcpReassemblyPacketCount. I checked out the documentation, which seems to define the default value, but I can't find a maximum value or anything stating what effect this will have on RAM usage. Does anyone know what the maximum value is and potentially a ratio of packets to RAM usage?

0 Karma

joeldavideng
Path Finder

In the absence of any guidance I just doubled the count to 1 million. I can't say this solved my problem, but it the agents didn't complain.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...