I would like to know if there is any way to increase the queue of my syslog group. I mean, currently I forward logs that are received on my Splunk through a tierce solution on syslog and the default queue is 97 KB. Please find below an example :
INFO Metrics - group=queue, name=my_syslog_group, max_size_kb=97, current_size_kb=0, current_size_kb=0, largest_size=0, smallest_size=0
I tried to set up this configuration on server.conf :
maxSize = 10MB
maxSize = 10MB
After restarting, I have always the default queue (97 KB). I saw nothing in the outputs.conf file to increase this queue for syslog output.
Do you have any idea ?
Thx for your help,
Just wondering if anyone has been able to come up with a fix / work-around for this issue.
It's 5 yrs since it was originally asked and still it appears that the config options are very limited for this.
I had a problem few months ago related to this: i tried to enlarge the maxQueueSize and my system was blocked because the full syslog queue blocked all the other queues(I was working on an Heavy Forwarder).
I opened a case to Splunk Support and they gave me two solutions:
I followed their first hint and I was able to send more data via syslog (around 20kb/s instead 1).
To do this, you have to add to your server.conf:
[general] parallelIngestionPipelines = 2
Before you ask: it isn't possible to use an higher value, I tried without results!
Your configuration option is wrong and needs to be on the outputs.conf configuration for the syslog.
maxQueueSize = [<integer>|<integer>[KB|MB|GB]|auto]
Thanks for your answser but could you please confirm us that this option setting "maxQueueSize" is for Syslog output.
I see on the documentation that this option is only for TCP output (splunk system)
Thanks a lot,