Monitoring Splunk

How is Max_size_kb determined

richnavis
Contributor

I am looking to troubleshoot performance problems (Indexing latency) on my splunk indexers. I noticed that there is a lot of blocking, apparently due to the max_size_kb being reached on the indexqueue. I am not seeing any disk latency, so not sure why this is happening..

Anyone know how the max_size_kb is determined, and if it is changeable?

1 Solution

ChrisG
Splunk Employee
Splunk Employee

Yes, it's in the queue settings of $SPLUNK/etc/system/local/server.conf (see http://docs.splunk.com/Documentation/Splunk/4.3/Admin/Serverconf for reference).

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

Yes, it's in the queue settings of $SPLUNK/etc/system/local/server.conf (see http://docs.splunk.com/Documentation/Splunk/4.3/Admin/Serverconf for reference).

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...