Getting Data In

"ThruputProcessor - Current data throughput (259 kb/s) has reached maxKBps." messages despite limits.conf file.

msarro
Builder

Hi everyone. I am receiving these messages on my forwarders:

10-16-2013 18:38:59.118 +0000 INFO  ThruputProcessor - Current data throughput (259 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf.

I actually have a limits.conf file deployed to all of my forwarders via an app. The contents of my limits.conf in the app/default directory are the following:

[thruput]
maxKBps = 0

Is there any reason this would not be listened to?

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi msarro,

you can run btool and see if your limits.conf gets applied

$SPLUNK_HOME/bin/splunk cmd btool limits list thruput

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi msarro,

you can run btool and see if your limits.conf gets applied

$SPLUNK_HOME/bin/splunk cmd btool limits list thruput

hope this helps ...

cheers, MuS

Shephali
Explorer

Hello,

I have a similar concern, where the maxKBps settings seem to be not getting applied.

The btool output on the UF is:
$/opt/splunk/laa/splunkforwarder/bin/splunk btool limits list --debug | grep -i maxkbps
/opt/splunk/laa/splunkforwarder/etc/apps/highoutput_forwarders/local/limits.conf maxKBps = 4096

But still we receive messages like " Current data throughput (1024 kb/s) has reached maxKBps” in the splunkd.log

Any suggestions?
Thanks in advance,
Shephali

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Shephali,

There are multiple possible reasons why this is not working:

  1. the option must be set under the [thruput] stanza in limits.conf
  2. btool does NOT actually show the config Splunk is using, it just merges the on disk files and shows the potential config being used by Splunk
  3. to see the actual live config Splunk uses run $SPLUNK_HOME/bin/splunk show config limits
  4. check / verify file permissions
  5. last but not least it could be a bug?

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...