Increased the limits to see if there is an increase in no.of events indexed in Splunk. ->added the following configuration in \system\local\inputs.conf [tcp://5540] queueSize = 50MB persistentQueueSize = 100MB ->Restarted Splunk -> Ran the test and still the no.of events remains 206 (where as the events available to send via TCP are 6500). *Note:- When i ran "splunk cmd btool --app=search inputs list", my output was [splunktcp://9997] connection_host = ip [tcp://5540] connection_host = dns disabled = 0 sourcetype = syslog Looks like my config changes have not been picked up even after the restart. Decreased the limits to 1KB and the no.of events remain the same (206). What could possibly be the issue here ? ... View more

I have searched the inputs.conf documentation and couldn't find anything related to out_rcv_buffer. I tried changing the queueSize to 50mb and restarted the splunk instance but even that didn't help. Could you please check to find the property? ... View more