Getting Data In

How to set the exec queue size in server.conf to increase perfmon inputs?


We are trying to increase the size of exec queue since we check that for Perfmon and Wineventlog, it stores the queue there. We don't want to increase the parsingQueue since there are other data that we are forwarding.

I try to set in server.conf:

maxSize = 10MB

However, when we monitored the metric.log, the max_size_kb is still 500KB as it original were.

The Forwarder we use is Universal Forwarder 6.4.1


0 Karma


First, you should not be setting queue sizes without consulting Splunk Support. Second, these queue sizes do not apply to the Universal Forwarder. These are index-time queues and exist only on the indexers.

If you are having problems with the performance of perfmon, you should take whatever action is appropriate at the Windows operating system level.

Be aware that WMI is the "Windows Management Interface" not the "Windows Monitoring Interface." It is not intended for high-volume monitoring.

0 Karma


Hi Iguinn,

thank you for the answer and recommendation. Currently we are monitoring Perfmon and Wineventlog
the reason for us trying to increase the queue is to ensure that we can still get the data for certain duration if the indexer is down. And currently the option for high availability is not viable because of resource constraint. Thanks


0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...