Getting Data In

ThruputProcessor - Current data throughput (266 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.?

pavanae
Builder

What does the message in the forwarder server "ThruputProcessor - Current data throughput (266 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.
" mean . I am trying to index the logs but i was seeing this message in the splunkd.log in the forwarder server. How can I fix this. Any Suggestions.

0 Karma
1 Solution

lguinn2
Legend

The Universal Forwarder (UF) is limited to 256 kb/s of network bandwidth by default. This is to keep it from the flooding the network on a production server. It appears that your UF is hitting this limit. If it is hitting this limit often, and if it is okay for the UF to use more of the network bandwidth, then change the setting in limits.conf

For example, if you want to allow the UF to user 512 kb/s , create or edit SPLUNK_HOME/etc/system/local/limits.conf on the UF.
Enter the following information (or update it, if it already exists):

[thruput]
maxKBps = 512

View solution in original post

lguinn2
Legend

The Universal Forwarder (UF) is limited to 256 kb/s of network bandwidth by default. This is to keep it from the flooding the network on a production server. It appears that your UF is hitting this limit. If it is hitting this limit often, and if it is okay for the UF to use more of the network bandwidth, then change the setting in limits.conf

For example, if you want to allow the UF to user 512 kb/s , create or edit SPLUNK_HOME/etc/system/local/limits.conf on the UF.
Enter the following information (or update it, if it already exists):

[thruput]
maxKBps = 512

imgarytan
Path Finder

Hi lguinn2, and pavanae

Would you guys please clarify What the consequence was, when this "Current data throughput (266 kb/s) has reached maxKBps" occurred?

All incoming event data got dropped? or partially dropped? or data simply flowing at the max speed?
Would the data flow catch up automatically if later the data came in at a speed below the maxKBps?
What was the best solution if the event data didn't get indexed?

Thanks a lot

lguinn2
Legend

Remember to restart the forwarder after making configuration file changes!

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...