Is there a way to set limits the amount of data stored in the Splunk Forwarder's cache memory?

[super_saiyan]

Hi, all

my understanding is splunk forwarders store data in the cache memory when transferring data to Splunk indexer.

is there a way to set limits the amount of data stored in the Splunk Forwarder's cache memory ???

[VatsalJagani]

@super_saiyan 

maxSize 

attribute in server conf.

Either for general [queue] stanza or [queue=<queue-name>] stanza.

I hope this helps!!!

[super_saiyan]

thank you so much @VatsalJagani , how do i re-check, if i configured correctly ?

[VatsalJagani]

CLI and check if you see what is configured

./splunk show config server

[isoutamo]

Hi

with @VatsalJagani you can check what splunk is currently used, after it has restarted/reloaded. Then with 

splunk btool server list --debug

You can see what you have configured on disk and from where it takes those into use after restart. This is useful to understand why some settings are not in use event you have put those on ("wrong") config file 😉

r. Ismo