Getting Data In

Is there a limit to the number of TCP listeners we can configure on a Heavy Forwarder (HF)?

Path Finder

Hi ,

We have configured a couple of Bluecoats on TCP custom ports on a HF. i see the data flowing in but the Bluecoat admins frequently comment that they are receiving alerts for failed upload to Splunk.

My 1st guess is that the port is exceeding the buffer limit or has filled up its queue.

But how can I ensure there is no data loss? Can we enable multiple listeners on a HF? We are to onboard more Bluecoats to Splunk through the same HF. Is there a limit to the number of listeners we can configure on a HF?

Does it affect performance?


0 Karma

Ultra Champion

i think it will be better to have a syslog receiver and have the forwarder monitor the syslog directories
read here:

0 Karma


Theoretical TCP port limit is 65535 minus your already in use ports. Can a single network card with 10baseT handle 10TB per day across that many ports? Probably not.

Does it affect performance, yes, extra network load requires extra resources like bonded network connections, load balancers, etc. but your software handling those connections will more likely be the cause of performance issues before your network is.

Your chasing a capacity question that only you can solve. It’s a professional engineering problem that’s always going to difficult to solve, but will always be best solved by yourself and a calculator and maybe some performance testing.

Start with a software designed to handle high amounts of network traffic over TCP and you’ll be off on the right foot. As @adonio suggested, rsyslog and syslog-ng are both good at handling large amounts of TCP traffic.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...