Getting Data In

Heavy Forwarder tier queues are full. How to determine which configuration might be causing issues?

daniel333
Builder

All,

I am looking at the queues on my heavy forwarder tier which I use to proxy all our Universal Forwarders. The queues are looking full lately, it seemed to creep up on us. Any recommendation on determining which config might be causing issues?

thanks

0 Karma

ryanoconnor
Builder

Which queues specifically are being blocked up? Depending on where the blocking is occurring will help determine what might be going on. Have you tried using the DMC to visualize the queues?

If the index queue is being blocked on the Heavy Forwarder than yes the maxKbps setting may apply.

0 Karma

somesoni2
Revered Legend

Check the limits.conf - maxKbps values might be limiting heavy forwarder's data transmissions to indexer and filling up the queue.

0 Karma

daniel333
Builder

My limits.conf setting for my Heavy Forwarders is this -

[root@LOCATIONp01SPLUNK303 default]# pwd
/opt/splunk/etc/apps/TA-COMPANY-int-limits.conf-thruput-unilimited/default
[root@LOCATIONp01SPLUNK303 default]# cat limits.conf
[thruput]
maxKBps = 0

0 Karma

phadnett_splunk
Splunk Employee
Splunk Employee

Hello Daniel, did you recently perform an upgrade?

0 Karma

daniel333
Builder

Yes we did. We moved from 6.3.3 to 6.4.1.

It's just my heavy forwarders, very easy to move back to 6.3.3 if you think that would be a factor?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!