Hello,
I don't quite understand the difference between the current_size_kb value and current_size value in the metrics.log for a Universal Forwarder. This is for the parsingqueue, as I am getting the "Could not send data to output queue" error in splunkd.log sometimes.
Metrics.log example line:
05-05-2016 19:03:06.209 +0000 INFO Metrics - group=queue, name=parsingqueue, max_size_kb=1228800, current_size_kb=1226982, current_size=19790, largest_size=19815, smallest_size=19692
So current_size_kb is almost the same size as my max_size_kb, but then current_size is only ~20MB. I started my maxSize value for parsingQueue in the server.conf at like 200MB, and every time I increased it, current_size_kb would increase as well.
Do I need to increase maxSize even more? Or should I just pay attention to current_size?
Thank you
↧