Getting Data In

Splunk forwarder delays only Concurrently generated logs

gsonal03
New Member

After reviewing splund.log, metrics.log in several attempts and adding check on storage etc. on splunk servers, we have received one pattern.
The only logs getting delayed by forwarder are the one's generated by multiple threads in an application. We have several single threaded applications that generate huge logs, but they don't get delayed during indexing.
While the one app running parallel jobs in multiple threads and generating relatively less logs, still gets delayed in indexing.

Is there any throttle limit that can be adjusted for allowing more logs to get forwarded to indexers per second?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...