Splunk Load Balancer Forwarder Performance Problem

clyde772 · ‎07-21-2012

Hey Splunkers,

Anyone who knows about setting up splunk forwarder as a load balancer to aggregate lower forwarder?

We have an issue where we are aggregating all lower forwarder traffic to a forwarder set-up as a load balanced forwarder. In this scenario, we have bottle neck at the aggregated forwarder where data is being queued not processing lower forwarder traffice fast enough. How can we set-up that aggregating LB forwarder to process at it's max to process all traffic as fast as possible.

Is there limits on max amount of traffic a forwarder can process as LB forwarder? we have looked at the limits.conf for thruput option which set to "0" to minimize any limits.

Thanks in advance~!

MarioM · ‎07-23-2012

have you looked into the maxQueueSize attribute in outputs.conf or [queue] maxSize in server.conf ?

Splunk Load Balancer Forwarder Performance Problem

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Splunk Load Balancer Forwarder Performance Problem

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas