Splunk Load Balancer Forwarder Performance Problem

clyde772 · ‎07-21-2012

Hey Splunkers,

Anyone who knows about setting up splunk forwarder as a load balancer to aggregate lower forwarder?

We have an issue where we are aggregating all lower forwarder traffic to a forwarder set-up as a load balanced forwarder. In this scenario, we have bottle neck at the aggregated forwarder where data is being queued not processing lower forwarder traffice fast enough. How can we set-up that aggregating LB forwarder to process at it's max to process all traffic as fast as possible.

Is there limits on max amount of traffic a forwarder can process as LB forwarder? we have looked at the limits.conf for thruput option which set to "0" to minimize any limits.

Thanks in advance~!

MarioM · ‎07-23-2012

have you looked into the maxQueueSize attribute in outputs.conf or [queue] maxSize in server.conf ?

Splunk Load Balancer Forwarder Performance Problem

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Splunk Load Balancer Forwarder Performance Problem

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future