increasing maxKBPS for only one splunk forwarder host

[kannu]

Hi Splunkers ,

I am getting this splunkd log entry in only one splunk forwarder .

05-09-2018 08:11:39.579 +0000 INFO ThruputProcessor - Current data throughput (258 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

Please let me know how to solve this only for particular splunk forwarder . For doing only for one splunk forwarder can i mention the below entry in splunk forwarder for which i want or do i need to mention that in indexer (but how to mention that in indexer only for one splunk forwarder host not for all)

[thruput]
# means unlimited
maxKBps = 0

[FrankVl · Accepted solution]

You configure that limit in the limits.conf on the respective forwarder, not the indexer.

[cpetterborg]

If you only want it on ONE forwarder, be sure to put it in a local/limits.conf file, to have the deployment server send the configuration to only the forwarder that you want.

[ddrillic]

Please be careful with opening it up. The forwarder might not be stable. You probably should check first the indexing latency for the past week or so, and determine if you truly have a problem...

[xpac]

This is also only a problem if it happens constantly. If you only have it happen a few times, it might just be fluctuation in data input.