Getting Data In

Will this limit this forwarding speed to the Indexer?

Dark_Ichigo
Builder

Will this limit this forwarding speed to the Indexer?

[thruput]
    maxKBps = <integer>
    * If specified and not zero, this limits the speed through the thruput processor to the specified 
    rate in kilobytes per second.
    * To control the CPU load while indexing, use this to throttle the number of events this indexer 
    processes to the rate (in KBps) you specify. 
0 Karma

jgedeon120
Contributor

Yes it does. It is set to default of 256 on universal forwarders.

0 Karma

Dark_Ichigo
Builder

The Universal Forwarder V.4.3.2 has the following as default which I just installed:

[thruput]
throughput limiting at index time
maxKBps = 0

0 Karma
Get Updates on the Splunk Community!

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...