Splunk Search

Help how to increase splunk forwarder capacity?

dhavamanis
Builder

there's a backlog of over 350,000,000 records and we are generating over 20,000,000 records per day just from this source. we need to increase the forwarding capacity in Splunk forwarder. can you please provide the configuration to increase the Splunk forwarding speed.

0 Karma
1 Solution

aholzer
Motivator

What error are you seeing in your $SPLUNK_HOME/var/log/splunk/splunkd.log?

If it is that your maxKBps has been reached and therefore it is throttling the amount of data being sent, then you can update "maxKBps" in your limits.conf:

[thruput]
#default for maxKBps is 256. If this is your problem, you may want to increase it
maxKBps = 256

Be careful increasing this number, as you may simply move the bottle neck to your indexers, if they don't have the capacity to handle that amount of data.

View solution in original post

aholzer
Motivator

What error are you seeing in your $SPLUNK_HOME/var/log/splunk/splunkd.log?

If it is that your maxKBps has been reached and therefore it is throttling the amount of data being sent, then you can update "maxKBps" in your limits.conf:

[thruput]
#default for maxKBps is 256. If this is your problem, you may want to increase it
maxKBps = 256

Be careful increasing this number, as you may simply move the bottle neck to your indexers, if they don't have the capacity to handle that amount of data.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...