Is there a troubleshooting guide for universal forwarder performance?

[renems]

Currently, I have a couple of universal forwarders that tend not to keep up with the data coming in. I see on the indexer side that latency starts to grow. I already raised the maxkbps, showing some relief. The thing is, I'd like to see where the bottleneck is occurring. As hard as I tried, I can't find any guide on troubleshooting universal forwarder performance. For instance, I'd like to see how data is flowing through the queues, and to what extent they are filled. Below the specs of one of the troublesome forwarders. Any thoughts?

Hostname:
<Servername>
Current Status:
active
Last Time Data Received:
06/15/2015 15:11:59
Forwarder Type:
universal forwarder
Splunk Version:
6.0.3
Platform:
Linux on x86_64
Source IP:
145.72.34.140
Destination Port:
9997
Connections This Period:
2951
Average KB Per Second:
2440.2481
Average Events Per Second:
7.1207

[dfronck]

Since it looks like you're still on 6.0, the Forwarder Health app might help. Hopefully Mark will update this for 6.2.

Additional views include looking at field descriptor and throughput limits being hit, duplicate GUIDs, and the version distribution and log volumes being generated by your agents.

Forwarder Health App