Is there a way to limit the thruput of my forwarder?

[the_wolverine]

I don't want my forwarder to consume too much bandwidth or other server resources sending out data. How can I limit thruput?

[the_wolverine · Accepted solution]

You can set the thruput in limits.conf via the [thruput] stanza. Example:

[thruput]
maxKBps = 256

• Alternatively, you can set maxKBps = 0 to lift any thruput cap. At this point you'll be limited by your actual bandwidth.

• Enabling the LightForwarder or using an universal forwarder will automatically set your thruput to 256 maxKBps.

• The same setting, when used on an indexer will also limit its thruput.

[yoho]

If you turn on compression, will this limit apply to the thruput before or after compression ?

[Simeon]

You can tune the indexing limit by editing the maxKBps parameter in the limits.conf file:

[thruput]

maxKBps = <integer>
* If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second.

As an example, the SplunkDesktop app will limit your thruput to 256KBps. This is to ensure you don't overload your desktop system where you installed Splunk.

For an environment that has limited resources, you may want to set this value. If you find that your indexing rate seems limited, or your events take a long time to show up, you should confirm that your Splunk instance DOES NOT have this value set.