×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ebay_nkitmitto
Engager
Member since: ‎02-03-2012
‎06-05-2020
Community Statistics
Posts 2
Solutions 1
Karma Given 4
Karma Received 11
Member Since ‎02-03-2012
Activity Feed
View All

Re: Splunk Universal Forwarder Slow

by in Getting Data In
‎04-26-2013 08:51 AM
6 Karma
‎04-26-2013 08:51 AM
6 Karma
By adding "maxQueueSize=500MB" to the outputs.conf file, under the [tcpout] stanza. Change the 500MB to whatever you wish. It defaults to 500kb I believe. But be careful, because whatever you set this number to, it will consume 3x more RAM. So if you have it set to 500MB, it'll consume 1500MB of RAM. Please this for more info (search for maxQueueSize): http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Outputsconf ... View more

Splunk Universal Forwarder Slow

by in Getting Data In
‎04-26-2013 08:49 AM
5 Karma
‎04-26-2013 08:49 AM
5 Karma
My Splunk forwarder is forwarding ~5 events per second (per my Deployment Monitor on my search head). The maxKBps is set to 20,000 and Splunk is transferring at a rate of 16,000 KBps. Why is the number of events so low? I have 27TB of data (and then some) that need to be indexed, these are historical log files. I do have indexer acknowledgement enabled in my environment as well. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma from
Karma given to
View All