Getting Data In

How do I edit Universal Forwarder aeq queue size?

martaBenedetti
Path Finder

Hi Community,

on Universal Forwarder I see these logs:

 

09-29-2022 12:12:17.410 +0200 INFO  Metrics - group=queue, name=aeq, blocked=true, max_size_kb=500, current_size_kb=499, current_size=61, largest_size=61, smallest_size=18

 

 

I know is related to gz files, in fact splunk is monitoring files gz.

In order to increase queue size, I usually push server.conf with new values, like this.

 

[queue=aeq]
maxSize = 2MB

 

 

It seems not working because I keep seeing in logs 

 

Metrics - group=queue, name=aeq, blocked=true, max_size_kb=500

 

 

Do you know how can be edited this queue size?

 

Thanks,

Marta

Labels (1)
Tags (1)
0 Karma

morawi5
Explorer

Any update on this topic? I also have set mine higher and the max_size_kb remains at 500.

0 Karma

SinghK
Builder

Need more info on that.. inputs.conf from indexer what port is configured etc.

outputs.conf from forwarder

0 Karma

martaBenedetti
Path Finder

Hi SinghK,

inputs.conf on indexers

 

[splunktcp-ssl:9997]
queueSize=4MB
disabled = 0

[SSL]
serverCert = $SPLUNK_HOME/etc/slave-apps/certs/myserver.pem
requireClientCert = true

 

 

outputs.conf on forwarder

 

[indexAndForward]
index                   = false

[tcpout]
defaultGroup            = my_indexers
forceTimebasedAutoLB    = true
indexAndForward         = false
clientCert              = $SPLUNK_HOME/etc/apps/certs/myserver.pem
useClientSSLCompression = true

[tcpout:my_indexers]
disabled                = false
useACK                  = true
server                  = idx1:9997,id2:9997,id3:9997,id4:9997,id5:9997,id6:9997

 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...