×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
rajakannan
Engager
Member since: ‎08-27-2016
‎06-05-2020
Community Statistics
Posts 2
Solutions 1
Karma Given 0
Karma Received 1
Member Since ‎08-27-2016
Activity Feed
View All

Re: Splunk forwarder throughput to indexer doesn't...

by in Getting Data In
‎08-28-2016 02:38 PM
1 Karma
‎08-28-2016 02:38 PM
1 Karma
MaxQueueSize=30MB was increased from the default values in the output.conf increased the performance significantly. I Would expect the forwarder to auto tune itself to meet the demand based on the system capacity and configurations, not really impressed with the defaults. ... View more

Splunk forwarder throughput to indexer doesn't imp...

by in Getting Data In
‎08-27-2016 02:21 PM
‎08-27-2016 02:21 PM
Splunk heavy forwarder throughput to indexer doesn't improve even after giving unlimited bandwidth maxKbps=0 , it's only getting 4MBps on a 24 core box with 128 GB RAM reading from nfs mount and forwarding to indexer on a 2x 10Gbps on a bonded interface. Reading from NFS is not an issues as we were able to read/write at 30MB/s outside the forwarder using typical copy (cp) What are the other limiting factors and what else can we tune from the Splunk side ? Please advise. Also we noted it's using only 1 TCP connection to indexer. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All