How to correctly set splunktcpin queue size on indexers?

[lukasz92]

Hi,

How to correctly set splunktcpin queue size on indexers?

I tried:

in server.conf:

[queue]
maxSize = 2MB

in inputs.conf:

[splunktcp://9997]
queueSize = 4M

Restarted indexers, but it doesn't help. I got events like:

03-12-2017 11:31:18.692 +0100 INFO Metrics - group=queue, name=splunktcpin, blocked=true, max_size_kb=500, current_size_kb=499, current_size=1352, largest_size=1352, smallest_size=0

[lukasz92 · Accepted solution]

I corrected

queueSize = 4M

to

queueSize = 4MB

and it works now.

[lukasz92]

rest query:

| rest services/data/inputs/tcp/cooked

tells me, that the queue size is set to 4M - but why there are new events with max_size_kb=500?