I have the following config in outputs.conf for splunk forwarder installed on a linux machine.
connectionTimeout = 20
defaultGroup = default-autolb-group
dropEventsOnQueueFull = -1
indexAndForward = false
maxConnectionsPerIndexer = 2
maxFailuresPerInterval = 2
maxQueueSize = 500KB
readTimeout = 300
secsInFailureInterval = 1
useACK = false
writeTimeout = 300
[tcpout:default-autolb-group]
autoLB = true
autoLBFrequency = 30
compressed = false
The forwarder is sending some historical logs too of past few months. As soon as splunk is started lot of processes on that machine cannot process due to lack of open ports as forwarder is using a lot of sockets i guess.
Is there anyway to limit the number of sockets it use?
... View more