Getting Data In

How to schedule a transfer on a forwarder?

shizl
Engager

I create a forwarder on a remote site. The speed of network is limited. I need transfer the event log in middle-night on the forwarder.

How can I configure the transfer start at middle-night, pause at six o'clock?

Thank you in advance.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Create a batch script that reduce the thruput during day time, and unleash the beast at night.
I assume that you are on windows
create %SPLUNK\_HOME%\etc\system\local\limits.conf_superslow

[thruput]
maxKBps=50
# default was 256

and create %SPLUNK\_HOME%\etc\system\local\limits.conf_superfast

[thruput]
maxKBps=0
# for unlimited

Then at night time run a batch using the windows scheduler (running under the correct user of course)

cp %SPLUNK_HOME%\etc\system\local\limits.conf_superfast %SPLUNK_HOME%\etc\system\local\limits.conf
%SPLUNK\_HOME%\bin\splunk restart

and in the morning

cp %SPLUNK_HOME%\etc\system\local\limits.conf_superslow %SPLUNK_HOME%\etc\system\local\limits.conf
%SPLUNK_HOME%\bin\splunk restart

0 Karma

bmacias84
Champion

@shizl, There are couple of ways to accomplish what your want or least come close, scripted input or oneshot. Please read my previous post. Hope this helps.

If your network is limited you may also want to enable indexer achnowledgement to prevent data lost in-flight.

Protect against loss of in-flight data

Answers: Can you set a certain time forwarding occurs

MarioM
Motivator

collect and transfer cannot be scheduled then you will need to use a local cron job to stop & start splunk.

Ayn
Legend

What do you mean? Configure what?

0 Karma

shizl
Engager

How to configure the forwarder or indexer without stop splunk?

0 Karma

shizl
Engager

How to configure the forwarder or indexer without stop splunk?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.