I am on-boarding data from 6 different locations the data flow is
Splunk Forwarder ------> DMZ Server (Intermediate Forwarder) -----------> Indexer
Initially I was getting aggqueue, parsingqueue, indexqueue and typingqueue blocked.
I had to set all this queue sizes in server.conf to maxSize = 2048MB,.
In limits.conf
[thruput]
maxKBps = 0
This worked for 5 locations. But for 1 location CPU consumption became very high which led to system freeze.
My question is, is there a way to onboard data without using much resources.
@gcusello please help
