Hey Splunkers,
Anyone who knows about setting up splunk forwarder as a load balancer to aggregate lower forwarder?
We have an issue where we are aggregating all lower forwarder traffic to a forwarder set-up as a load balanced forwarder. In this scenario, we have bottle neck at the aggregated forwarder where data is being queued not processing lower forwarder traffice fast enough. How can we set-up that aggregating LB forwarder to process at it's max to process all traffic as fast as possible.
Is there limits on max amount of traffic a forwarder can process as LB forwarder? we have looked at the limits.conf for thruput option which set to "0" to minimize any limits.
Thanks in advance~!
