Getting Data In

Will this limit this forwarding speed to the Indexer?

Dark_Ichigo
Builder

Will this limit this forwarding speed to the Indexer?

[thruput]
    maxKBps = <integer>
    * If specified and not zero, this limits the speed through the thruput processor to the specified 
    rate in kilobytes per second.
    * To control the CPU load while indexing, use this to throttle the number of events this indexer 
    processes to the rate (in KBps) you specify. 
0 Karma

jgedeon120
Contributor

Yes it does. It is set to default of 256 on universal forwarders.

0 Karma

Dark_Ichigo
Builder

The Universal Forwarder V.4.3.2 has the following as default which I just installed:

[thruput]
throughput limiting at index time
maxKBps = 0

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...