Tried the TCP tweaking, but it doesn't help. Vista introduced "TCP auto tuning" which makes Windows' TCP performance much better, and the old tweaking parameters don't tend to help.
Setting a large receive window on the indexer made no difference. I've used a TCP proxy on the forwarder that has a large send buffer, and that will send to an unmodified and untuned indexer at >400kbytes/s -- it'd be tidier to set the TCP send buffer inside Splunk itself.
That Python proxy looks suspiciously slow (small buffer size, synchronous read/write calls) so I think I'll stick with my hacked up rinetd.
... View more