Getting Data In

How to limit heavy forwarder bandwidth in limits.conf?

realsplunk
Motivator

Hello guys,

is it possible to limit Heavy forwarders bandwidth like UF (setting [thruput] in limits.conf for forwarders)?

Thanks.

Labels (2)
0 Karma
1 Solution

realsplunk
Motivator

From support : "Splunk Heavy Forwarder does not have setting to limit network bandwidth."

View solution in original post

0 Karma

realsplunk
Motivator

From support : "Splunk Heavy Forwarder does not have setting to limit network bandwidth."

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @realsplunk,
yes it's the same thing, only one hint beware to the traffic to avoid that your HF will be the bottle neck of your network.

Ciao.
Giuseppe

0 Karma

realsplunk
Motivator

Hi Cusello,
we have +800 KB/s indexing Checkpoint through OPSEC app and other syslogs through tcp/udp basically.

Here are the confs :

[root@HFSIEM01 ~]# grep -r -i maxKBps /OPT/siem/splunk/etc
/OPT/siem/splunk/etc/system/README/server.conf.spec:    1. maxKBps (in limits.conf)
/OPT/siem/splunk/etc/system/README/limits.conf.spec:maxKBps = <integer>
/OPT/siem/splunk/etc/system/README/limits.conf.spec:  * The thruput processor applies the 'maxKBps' setting for each
/OPT/siem/splunk/etc/system/README/limits.conf.spec:    pipelines, the processor multiplies the 'maxKBps' value

/OPT/siem/splunk/etc/system/default/limits.conf:maxKBps = 0
/OPT/siem/splunk/etc/apps/SplunkLightForwarder/default/limits.conf:maxKBps = 256

If I understand conf file precedence and if it applied, the limit should be 256?

Thanks.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!