Getting Data In

After configuring a limit on the forwarder's rate of thruput, why is the maxKBps setting still being exceeded?

Moon629
Explorer

I set up the limits.conf file as the following and save in the path /opt/splunkforwarder/etc/system/local/limits.conf

[thruput]
maxKBps = 512

But when the logs are increasing, sometimes it was exceeded 512Kb, even up to 3000kb.

Can someone please solve this problem? thanks in advance.

0 Karma

sfmandmdev
Path Finder

Which Splunk version are you using?
We reported a bug in 6.3.2 UF recently.

0 Karma

Moon629
Explorer

We didn't upgrade UF, so they are still in 6.2

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Can you confirm you do not have any other apps that are overwriting this setting?

$splunk_home$/splunk btool limits list --debug | grep -i maxkbps

This will show you all configurations that have this applied. I imagine you have an app that is taking priority and overwriting your 512kb setting.

0 Karma

Moon629
Explorer

Below is my search for your reference.

index=_internal source=*metrics*"group=tcpin_connections" "tcp_KBps"  | rename _tcp_KBps as tcp_KBps | table sourceHost, kb, tcp_KBps | where tcp_KBps > 512
0 Karma

Moon629
Explorer

I have run the above command line...but only have one configuration.

./splunk btool limits list --debug | grep -i maxkbps
/opt/splunkforwarder/etc/system/local/limits.conf maxKBps = 512

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...