Getting Data In

How do I configure my SplunkForwarder to have the least impact in the case my index server is unavailable?

Path Finder

We have run into a few cases over the last year where our index server is unavailable (either disk is full or offline for maintenance). During that time, we see the SplunkForwarder on our Windows 2008 servers consume 1-2 entire CPU's at 100% each.

Understanding that one solution (that I won't get money approved to do) would be to have redundancy at the indexer level....

I'm looking for tips on Forwarder configurations (I'm guessing via outpus.conf) that will minimize the performance impact on the Forwarding machine in the case that the indexer is unavailable. I've read some things in the documentation, but I'm hoping for some more real world lessons learned type of input.

Thanks for your time.

Tags (2)
0 Karma

Path Finder

Is anyone able to offer input on my question???

0 Karma

Path Finder

anyone? Bueller?

0 Karma

Path Finder

We always enable the "SplunkLightForwarder" app and have not seen any issues with it in production.

0 Karma

Path Finder

Thanks - we are using the SplunkForwarder so any LightForwarder benefits won't apply to us.

0 Karma