Security

Log latency

VijaySrrie
Builder

Hi Team,

We could see latency in logs

Log ingestion via - syslog

Network devices --> Syslog server --> splunk 

Using below query, we could see minimum 10 mins to maxminum 60 mins log latency

index="ABC" sourcetype="syslog" source="/syslog*" 
| eval indextime=strftime(_indextime,"%c")
| table _raw _time indextime



What should be our next steps to check where the latency is and how to fix it?

Labels (1)
0 Karma
1 Solution

VijaySrrie
Builder

@KendallW 
INFO ThruputProcessor [2963 parsing] - Current data throughput (5125 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

We will try increasing the limits.

View solution in original post

0 Karma

VijaySrrie
Builder

@KendallW 
INFO ThruputProcessor [2963 parsing] - Current data throughput (5125 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

We will try increasing the limits.

0 Karma

KendallW
Contributor

Hi @VijaySrrie assuming you are collecting the logs on syslog server then forwarding to Splunk with a UF?
You can check if the UF is reaching its thruput limit which could cause indexing lag:

index=_internal sourcetype=splunkd component=ThruputProcessor "has reached maxKBps" 



Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...