Splunk Search

Can I lose events if the bandwidth limit on my LightWeightForwarder is set too low?

maverick
Splunk Employee
Splunk Employee

On my LightWeightForwader (LWF), if I set the bandwidth thruput limit in limits.conf too low and the queue fills up on the LWF, will it back off until it has sent the queue? Or could you lose data?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

If the limit is so low that monitored file rolls (and the rolled filename isn't being monitored) before it can be sent, then yes, you will lose the events that remained in that file. This can happen if the amount written to the file is higher than the limit over a long enough period of time, or if the file rolls over very quickly.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

If the limit is so low that monitored file rolls (and the rolled filename isn't being monitored) before it can be sent, then yes, you will lose the events that remained in that file. This can happen if the amount written to the file is higher than the limit over a long enough period of time, or if the file rolls over very quickly.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...