Getting Data In

How do I edit Universal Forwarder aeq queue size?

Path Finder

Hi Community,

on Universal Forwarder I see these logs:


09-29-2022 12:12:17.410 +0200 INFO  Metrics - group=queue, name=aeq, blocked=true, max_size_kb=500, current_size_kb=499, current_size=61, largest_size=61, smallest_size=18



I know is related to gz files, in fact splunk is monitoring files gz.

In order to increase queue size, I usually push server.conf with new values, like this.


maxSize = 2MB



It seems not working because I keep seeing in logs 


Metrics - group=queue, name=aeq, blocked=true, max_size_kb=500



Do you know how can be edited this queue size?




Labels (1)
Tags (1)
0 Karma


Any update on this topic? I also have set mine higher and the max_size_kb remains at 500.

0 Karma


Need more info on that.. inputs.conf from indexer what port is configured etc.

outputs.conf from forwarder

0 Karma

Path Finder

Hi SinghK,

inputs.conf on indexers


disabled = 0

serverCert = $SPLUNK_HOME/etc/slave-apps/certs/myserver.pem
requireClientCert = true



outputs.conf on forwarder


index                   = false

defaultGroup            = my_indexers
forceTimebasedAutoLB    = true
indexAndForward         = false
clientCert              = $SPLUNK_HOME/etc/apps/certs/myserver.pem
useClientSSLCompression = true

disabled                = false
useACK                  = true
server                  = idx1:9997,id2:9997,id3:9997,id4:9997,id5:9997,id6:9997



0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...