Universal Forwarder - setting maxKBps via cli

[mrjsnook]

I've looking around for a way to set maxKBps via cli. Most of the splunk answers suggest manually editing the limits.conf file but I'm looking for a way to do this programmatically. Anyone have any suggestion on how to do this?

Thanks

[rgaleone1]

mrjsnook -
Your question is tagged with a universalforwarder tag; so two solutions, depending on your deployment.

---

1. Small deployments, use sed (assuming you are using *nix) to read in the current value of maxKBps from limits.conf and update the value. Alternatively, use the large deployment solution.
2. Large deployments, create an app for specifically updating maxKBps in limits.conf and push the conf file out to the nodes which require the update.

Remember regardless of the path you choose, you must restart Splunk to enable configurations.

---

To verify values Splunk is reading from all limits.conf files use:

 $SPLUNK_HOME/bin/splunk cmd btool limits list --debug