In my splunk environment i have around 50-60 instances of splunktcpin queue blocked?
what is the impact on my data if splunktcpin queue is blocked? Would i be losing some data forwarded from my universal forwarder?
WHen you say a queue is blocked, how long will the queue be blocked?
basically you can say that a queue is blocked until the congestion in the next queue is removed.
Most cases for blocked queues are either a temporary indexer overload, slow disks or forwarders sending too much data for what ever reason (some java log from a application gone crazy for example).
You can limit the forwarder to not sent too much data at once in limits.conf:
maxKBps = <integer>
* If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second.