No, sorry, i did not mention that INDEXERS manage queues OK, they do not get over 10/20% in a full day, by media is 1/5% per INDEXER. HF was the issue. Leaving queues by default it can't manage the flows, raising to 2GB it does. My question is: with 16GB server, is there any risk raising to 2GB per queue, or, maybe, also more over? Best Practices what suggest about it? For now, with 2GB/queue i got no issues in data flow (and there is much much data!!!). The only little issue i encountered is that, sometimes, during the day, maybe for some networking problems, i found HF to do much os swap, and, in some cases, kernel killed the splunkd process for full swap usage.
... View more