I'm migrating my Splunk Instance from an outdated OS. I want to increase the buffer size for my Splunk forwarder so that it can withstand all the logs when the receiver/ Indexer is down. We are using Splunk version 6.6.0, I'm unable to find relevant documentation for referring to the configuration file changes.
as @richgalloway said most of parameters are still in use. Just look version 7.0.0 to get the nearest docs. You found those settings at least server and inputs conf files. If/when you are talking about intermediate forwarders you should ensure that you are using also persistent disk queues and not only memory based. Otherwise you lost events if nodes or services goes down before indexers are up.
That setting probably has not changed over the years since 6.6.0. The docs don't specify a maximum value so it may be limited only by the amount of memory available on your server.
--- If this reply helps you, Karma would be appreciated.
