Will a splunk lightfowarder use the same AQ-queue Archive Processor mechanism like the full-blown splunk server, when it works on a Log Server with a lot .gz-files?
The cause of my question is that we have performance problems during indexing ".gz" files directly on the Splunk Server (after rsyncing them to it). It takes too long.
A workaround could be to use a lightforwarder on the LogServer, but if it works the same way it changes nothing.
The Splunk Server has enough resources:
- only one core of eight is used frequently through indexing (Archive Processor)
- storage has no or little wait io
... View more