ThruputProcessor - Current data throughput (266 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.?

[pavanae]

What does the message in the forwarder server "ThruputProcessor - Current data throughput (266 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.
" mean . I am trying to index the logs but i was seeing this message in the splunkd.log in the forwarder server. How can I fix this. Any Suggestions.

[lguinn2 · Accepted solution]

The Universal Forwarder (UF) is limited to 256 kb/s of network bandwidth by default. This is to keep it from the flooding the network on a production server. It appears that your UF is hitting this limit. If it is hitting this limit often, and if it is okay for the UF to use more of the network bandwidth, then change the setting in limits.conf

For example, if you want to allow the UF to user 512 kb/s , create or edit SPLUNK_HOME/etc/system/local/limits.conf on the UF.
Enter the following information (or update it, if it already exists):

[thruput]
maxKBps = 512

[imgarytan]

Hi lguinn2, and pavanae

Would you guys please clarify What the consequence was, when this "Current data throughput (266 kb/s) has reached maxKBps" occurred?

All incoming event data got dropped? or partially dropped? or data simply flowing at the max speed?
Would the data flow catch up automatically if later the data came in at a speed below the maxKBps?
What was the best solution if the event data didn't get indexed?

Thanks a lot

[lguinn2]

Remember to restart the forwarder after making configuration file changes!