Quick question -
I realise that putting a forwarder into lightweight mode will automatically limit throughput by default to 256Kbps.
Can I add in a limits.conf entry to the etc/system/local folder on the forwarder and increase this limit to say 500Kbps?
e.g.
[thruput]
maxKBps = 500
Will this override the 256 limit in the lightweight forwarder or is the limit fixed, because it is lightweight or something?
Many thanks
You are correct. Settings in local override settings in default. It is not fixed due to it being a light weight forwarder. It is simply a default value that can be overwritten as you mention. Splunk docs on configuration file precedence contain more details.
You are correct. Settings in local override settings in default. It is not fixed due to it being a light weight forwarder. It is simply a default value that can be overwritten as you mention. Splunk docs on configuration file precedence contain more details.
if ypu use this setting, it will be unlimited (as on heavy forwarders, and indexers)
[thruput]
maxKBps = 0
This fact should really be added to the documentation around the lightweight forwarder differences.