Getting Data In

GCP Pub/Sub Event Volumes via Heavy Forwarder

Path Finder

I'm trying to send some busy logs through a Heavy Forwarder into our Splunk Cloud so we can do some aggregation to reduce the volume hitting the Cloud IDM. The feeds are picked up via Pub/Sub topics in GCP and when they're transferred to the Heavy Forwarder, the volume of events coming through is only about 5% of the volume that was hitting the Cloud IDM. Nothing has been changed on the GCP side and the VM running the Heavy Forwarder is highly spec'd and is showing virtually no load on CPU, memory or networking.

Any ideas as to what could be wrong?


Labels (1)
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...