Hi! Is there any way to make data retrival rate slower? Something like 1h worth of data every 1m
When we are trying to save 30D data from our elastic(about 4.4m events) server makes huge network load spike and then stops responding.
https://docs.splunk.com/Documentation/Splunk/9.3.0/Admin/Outputsconf
There are many options available in the outputs.conf.spec sheet. You can start setting queue and buffers but be cautious that data in queues and buffers can age out and risk no ingestion.
The other thing is try setting compression to reduce the network traffic demands but it will increase the CPU demands on source and destination so make sure that you have cycles to spare.