Archive
Highlighted

Does having two tcpout outputs defined effectively double the throughput being measured when maxKBps is exceeded and throttling takes place?

Builder

We are in a transition phase with Splunk Cloud and forwarding to Splunk Cloud index endpoints as well as an on-prem indexer cluster. Does having two tcpout outputs defined effectively double the throughput being measured when maxKBps is exceeded and throttling takes place?

This is mostly relating to Universal Forwarders as they have a default of 256 KB/s (as does the app that splunk cloud provided for forwarding to splunk cloud).

0 Karma