Hi,
How to correctly set splunktcpin queue size on indexers?
I tried:
in server.conf:
[queue]
maxSize = 2MB
in inputs.conf:
[splunktcp://9997]
queueSize = 4M
Restarted indexers, but it doesn't help. I got events like:
03-12-2017 11:31:18.692 +0100 INFO Metrics - group=queue, name=splunktcpin, blocked=true, max_size_kb=500, current_size_kb=499, current_size=1352, largest_size=1352, smallest_size=0
I corrected
queueSize = 4M
to
queueSize = 4MB
and it works now.
rest query:
| rest services/data/inputs/tcp/cooked
tells me, that the queue size is set to 4M - but why there are new events with max_size_kb=500?