data not getting populated in dashboard

[pratapa]

Hi,

In our environment, user is complaining that data is not getting populated in dashboard.

We logged into the client server and checked splunkd.log file

Following is the snippet from splunkd.log file

12-24-2019 20:51:10.865 +1100 WARN TcpOutputProc - Connected to idx=10.240.71.21:9997. Not using ACK.
12-24-2019 20:51:14.696 +1100 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
12-24-2019 20:51:16.744 +1100 INFO TailingProcessor - ...continuing.
12-24-2019 20:51:22.756 +1100 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
12-24-2019 20:51:23.781 +1100 INFO TailingProcessor - ...continuing.
12-24-2019 20:52:48.329 +1100 INFO BatchReader - Removed from queue file='/opt/splunkforwarder/var/log/splunk/metrics.log.1'.
12-24-2019 20:54:25.167 +1100 INFO BatchReader - Removed from queue file='/opt/splunkforwarder/var/log/splunk/metrics.log.2'.
12-24-2019 20:55:50.998 +1100 INFO ThruputProcessor - Current data throughput (258 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.
12-24-2019 20:56:02.032 +1100 INFO BatchReader - Removed from queue file='/opt/splunkforwarder/var/log/splunk/metrics.log.3'.
12-24-2019 20:57:39.896 +1100 INFO BatchReader - Removed from queue file='/opt/splunkforwarder/var/log/splunk/metrics.log.4'.
12-24-2019 20:59:16.735 +1100 INFO BatchReader - Removed from queue file='/opt/splunkforwarder/var/log/splunk/metrics.log.5'.
12-24-2019 21:00:51.015 +1100 INFO ThruputProcessor - Current data throughput (260 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

We found that maxKBps has set to 0 in limits.conf file.

[thruput]

throughput limiting at index time

maxKBps = 0

Please suggest what should be the maxKBps value in limits.conf file to make the data forwarding to indexer.

Pratapa.

[mydog8it]

The setting in the limits.conf file needs to be set to what your environment demands. If the server's network connection is already taxed with business activity, you might not want to sacrifice business throughput for improved Splunk data collection. However if you have the bandwidth available move the setting higher to allow for better data forwarding performance. If Splunk data collection is paramount, set it to "0" and Splunk will use whatever it needs to forward the data.
Ultimately you should consider if this server represents a usual performance for your environment and the appropriate setting adopted as part of your standard Splunk Forwarder deployment.

Hope this helps

[richgalloway]

Which limits.conf file has that setting? The one on the forwarder is the one that matters.