Getting Data In
Highlighted

Is there a way to increase the maxQueueSize for Syslog output?

Path Finder

Hello Splunkers,

I would like to know if there is any way to increase the queue of my syslog group. I mean, currently I forward logs that are received on my Splunk through a tierce solution on syslog and the default queue is 97 KB. Please find below an example :

INFO Metrics - group=queue, name=mysysloggroup, maxsizekb=97, currentsizekb=0, currentsizekb=0, largestsize=0, smallestsize=0

I tried to set up this configuration on server.conf :

[queue]
maxSize = 10MB

[queue:mysysloggroup]
maxSize = 10MB

After restarting, I have always the default queue (97 KB). I saw nothing in the outputs.conf file to increase this queue for syslog output.

Do you have any idea ?

Thx for your help,

Regards,

Ludo

Tags (3)
Highlighted

Re: Is there a way to increase the maxQueueSize for Syslog output?

SplunkTrust
SplunkTrust

Your configuration option is wrong and needs to be on the outputs.conf configuration for the syslog.

maxQueueSize = [<integer>|<integer>[KB|MB|GB]|auto]

See:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf
0 Karma
Highlighted

Re: Is there a way to increase the maxQueueSize for Syslog output?

Path Finder

Hello alacercogitatus,

Thanks for your answser but could you please confirm us that this option setting "maxQueueSize" is for Syslog output.

I see on the documentation that this option is only for TCP output (splunk system)

Thanks a lot,

Regards,

Ludo

0 Karma