Splunk Search

Splunk Listen Backlog Queue

chrisgoffient
New Member

I have a client that is using Splunk enterprise using TCP, we've been monitoring the number of ListenOverflows, and increased net.core.somaxconn from the original 128. We noticed after a splunk restart, it looks like listen(...) is still setting 128. Is there a tunable in Splunk for TCP over 9997? I couldn't find it in the documentation. Most systems allow this to be tunable (i.e nginx, apache, etc).

Tags (2)
0 Karma

mwidjaja_splunk
Splunk Employee
Splunk Employee

To make that change, you'll need to edit $SPLUNK_HOME/etc/splunk-launch.conf and add this line below
SPLUNK_LISTEN_BACKLOG=new setting

And restart

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...