Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How does sending data of Splunk Universal Forwarder works

$
0
0
Hi, I was monitoring Universal Forwarder's CPU usage with the environment below, and I put 13GB sized file on Universal Forwarder server to send to the indexer and monitored it with limits.conf set maxKBps = 1024. I noticed that most of the times CPU isn't used, however, every 30 seconds it jumps up to about 10%. I checked splunkd.log on UF to see what's going on, and saw this error *"Could not send data to output queue (parsing queue), retrying...."*, and at the same time the the summary count on Indexer goes up. It seems like the Universal Forwarder is sending data to Indexer only every 30 seconds? Are there any interval for UF to send data or is the Indexer controlling UF from sending the data? Indexer : OS - Windows Server 2012 r2 Splunk - 6.3.2 Universal Forwarder : OS - Centos64 Splunk - 6.3.2

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>