diff --git a/default/data/ui/views/splunk_forwarder_output_tuning.xml b/default/data/ui/views/splunk_forwarder_output_tuning.xml index ebfcc7a..93b5613 100644 --- a/default/data/ui/views/splunk_forwarder_output_tuning.xml +++ b/default/data/ui/views/splunk_forwarder_output_tuning.xml @@ -112,7 +112,7 @@
Also note that the maxQueueSize should not be below 10MB (10MB minimium size)
If you are using an AWS NLB, you may wish to refer to this newer post Asynchronous forwarding with NLB
Finally while this also works on UF's, there are some reasons why you may want to consider HF's if you are running an intermediate tier, answers post Wrongly merged Events/permanently blocked tcpout queue with Intermediate Universal Forwarder
-Finally you may want to refer to Slow indexer/receiver detection capability
What config is used to achieve the above?
outputs.conf file based on 1MB/s
maxQueueSize = 10MB
@@ -129,12 +129,6 @@
connectionTTL = 300
- heartbeatFrequency = 15
-
- #heartbeatFrequency = 15 for useACK, 350 for non-useACK
-