Splunk Load Balancer Forwarder Performance Problem

[clyde772]

Hey Splunkers,

Anyone who knows about setting up splunk forwarder as a load balancer to aggregate lower forwarder?

We have an issue where we are aggregating all lower forwarder traffic to a forwarder set-up as a load balanced forwarder. In this scenario, we have bottle neck at the aggregated forwarder where data is being queued not processing lower forwarder traffice fast enough. How can we set-up that aggregating LB forwarder to process at it's max to process all traffic as fast as possible.

Is there limits on max amount of traffic a forwarder can process as LB forwarder? we have looked at the limits.conf for thruput option which set to "0" to minimize any limits.

Thanks in advance~!

[MarioM]

have you looked into the maxQueueSize attribute in outputs.conf or [queue] maxSize in server.conf ?