explore decreasing TcpTimedWaitDelay and increasing MaxUserPort: REG_DWORD named TcpTimedWaitDelay should be set for the value of 30 seconds, as opposed to default value being 4 minutes & MaxUserPort to 65534 located here HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters also modify the dynamic port range using netsh int ipv4 set dynamicport tcp start=10000 num=50000 to expand dynamic port range ... View more

I've changed the file as suggested, but having restarted Splunk on that heavy forwarder I don't see any event count decrease. I run "* source="udp:514" index=network | timechart count" which are ingested via that heavy forwarder... ... View more

Hi MuS, Thank you for your comments. The indexes.conf on the master(C:\Program Files\Splunk\etc\master-apps_cluster\local) sets "repFactor=auto", which should result in the index's data to be replicated to other peers in the cluster, and I've not come across any other settings. As far as the outputs.conf is concerned on the universal forwarders - the way I understand this is that we are not cloning data, but merely balancing between the two indexers: [tcpout:indexers] disabled=false autoLBFrequency=40 server=10.250.156.60:9997,10.250.156.61:9997 useACK=true Similarly the following is the outputs.conf from a heavy forwarder that handles syslog traffic. Here however I don't see useACK - does that mean that if index replica was disabled = some events will not have been indexed and therefore lost? [tcpout] defaultGroup = default-autolb-group [tcpout-server://10.250.156.60:9997] [tcpout:default-autolb-group] disabled = false server = 10.250.156.60:9997,10.250.156.61:9997 [tcpout-server://10.250.156.61:9997] ... View more