GCP Pub/Sub Event Volumes via Heavy Forwarder

[moogmusic]

I'm trying to send some busy logs through a Heavy Forwarder into our Splunk Cloud so we can do some aggregation to reduce the volume hitting the Cloud IDM. The feeds are picked up via Pub/Sub topics in GCP and when they're transferred to the Heavy Forwarder, the volume of events coming through is only about 5% of the volume that was hitting the Cloud IDM. Nothing has been changed on the GCP side and the VM running the Heavy Forwarder is highly spec'd and is showing virtually no load on CPU, memory or networking.

Any ideas as to what could be wrong?

Thanks