Splunk Search

Can I lose events if the bandwidth limit on my LightWeightForwarder is set too low?

Splunk Employee
Splunk Employee

On my LightWeightForwader (LWF), if I set the bandwidth thruput limit in limits.conf too low and the queue fills up on the LWF, will it back off until it has sent the queue? Or could you lose data?

1 Solution

Splunk Employee
Splunk Employee

If the limit is so low that monitored file rolls (and the rolled filename isn't being monitored) before it can be sent, then yes, you will lose the events that remained in that file. This can happen if the amount written to the file is higher than the limit over a long enough period of time, or if the file rolls over very quickly.

View solution in original post

Splunk Employee
Splunk Employee

If the limit is so low that monitored file rolls (and the rolled filename isn't being monitored) before it can be sent, then yes, you will lose the events that remained in that file. This can happen if the amount written to the file is higher than the limit over a long enough period of time, or if the file rolls over very quickly.

View solution in original post