Increase Throughput Limit on a Lightweight Forwarder

[pj]

Quick question -

I realise that putting a forwarder into lightweight mode will automatically limit throughput by default to 256Kbps.

Can I add in a limits.conf entry to the etc/system/local folder on the forwarder and increase this limit to say 500Kbps?

e.g.

[thruput]
maxKBps = 500

Will this override the 256 limit in the lightweight forwarder or is the limit fixed, because it is lightweight or something?

Many thanks

[bwooden · Accepted solution]

You are correct. Settings in local override settings in default. It is not fixed due to it being a light weight forwarder. It is simply a default value that can be overwritten as you mention. Splunk docs on configuration file precedence contain more details.

[yannK]

if ypu use this setting, it will be unlimited (as on heavy forwarders, and indexers)

[thruput]

maxKBps = 0

[pj]

This fact should really be added to the documentation around the lightweight forwarder differences.