Skip to content

Commit

Permalink
Update splunk_forwarder_output_tuning.xml
Browse files Browse the repository at this point in the history
  • Loading branch information
gjanders authored Sep 2, 2024
1 parent a3e388d commit 3295923
Showing 1 changed file with 1 addition and 7 deletions.
8 changes: 1 addition & 7 deletions default/data/ui/views/splunk_forwarder_output_tuning.xml
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@
<p>Also note that the maxQueueSize should not be below 10MB (10MB minimium size)</p>
<p>If you are using an AWS NLB, you may wish to refer to this newer post <a href="https://www.linkedin.com/posts/harendra-rawat-b10b41_asynchronous-forwarding-with-nlb-activity-7112204069363933185-SYRv"> Asynchronous forwarding with NLB</a></p>
<p>Finally while this also works on UF's, there are some reasons why you may want to consider HF's if you are running an intermediate tier, answers post <a href="https://community.splunk.com/t5/Getting-Data-In/Wrongly-merged-Events-permanently-blocked-tcpout-queue-with/m-p/508743">Wrongly merged Events/permanently blocked tcpout queue with Intermediate Universal Forwarder</a></p>
<br/>
<br/><p>Finally you may want to refer to <a href="https://community.splunk.com/t5/Knowledge-Management/Slow-indexer-receiver-detection-capability/m-p/683768">Slow indexer/receiver detection capability</a></p>
<p>What config is used to achieve the above?</p>
<p>outputs.conf file based on 1MB/s
</p><p><code>maxQueueSize = 10MB</code>
Expand All @@ -129,12 +129,6 @@
<p>
<code>connectionTTL = 300</code>
</p>
<p>
<code>heartbeatFrequency = 15</code>
</p>
<p>
<code>#heartbeatFrequency = 15 for useACK, 350 for non-useACK</code>
</p>
</body>
</html>
</panel>
Expand Down

0 comments on commit 3295923

Please sign in to comment.