Why does it take time to transfer a gz file?

[yutaka1005]

In my system architecture, UF is transfering 1.8GB GZ format Compressed ifilter log(original size is 15GB) to two IDX.
However, the transfer speed is very slow. In my calculation it will take around 24 hours to send all the logs.

The value of maxKbps is set to 0, So I am thinking that expand of the GZ file cause the matter.

But may such a matter occur?

[martin_mueller · Accepted solution]

Make sure you don't change limits.conf in etc/system/default, instead create one in etc/system/local or etc/apps/some_app/local - else all changes are lost on upgrade of Splunk.

[yutaka1005]

Thanks for your answer! I changed limits.conf in etc/system/local.

[martin_mueller]

UFs are capable of unpacking gzip at more than 20kb/s (1.8GB in 24h) - something else is going on.

[yutaka1005]

Thanks for your comments ! I overlooked that "maxKBps = 256" was set in "/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/limits.conf". When I changed the setting value, the transfer was successfully done.