the queue splunktcpin name is uncleare on the configure.
both server.conf
[queue=splunktcpin]
maxSize = 1600MB
and inputs.conf
[splunktcp://9997]
compressed = true
enableS2SHeartbeat = false
queueSize = 1GB
dont effect!
metrics.log always display splunktcpin queue size is 500.
03-10-2014 14:40:05.847 +0800 INFO Metrics - group=queue, name=splunktcpin, max_size_kb=500, current_size_kb=0, current_size=0, largest_size=1, smallest_size=0
You can set the splunktcpin queue size in inputs.conf.
i was find out the problem source , i was through web interface add some splunktcp port,so the
/opt/splunk/etc/apps/launcher/local/inputs.conf
have this web add port configure,then the
/opt/splunk/etc/system/local/inputs.conf
is not effect!
i was find out the problem source , i was through web interface add some splunktcp port,so the
/opt/splunk/etc/apps/launcher/local/inputs.conf
have this web add port configure,then the
/opt/splunk/etc/system/local/inputs.conf
is not effect!
i was find out the problem source , i was through web interface add some splunktcp port,so the
/opt/splunk/etc/apps/launcher/local/inputs.conf
have this web add port configure,then the
/opt/splunk/etc/system/local/inputs.conf
is not effect!
[queue=tcpin_queue]
maxSize = 100MB