We run Windows indexers here and we have around 2000 Universal Forwarders connecting to 6 indexers.
When I look at the established splunktcp://9997 connections on the indexers, none of them show more than 500 established connections (from the UFs).
Should I expect all the UFs to be able to establish a connection to all the indexers? (i.e. to get to around 2000 inbound UF connections on the indexers?)
I don't think there is a Splunk imposed limit here, instead, I think I might be hitting a Windows limit. OS is 2012 R2, hosts have CPU, RAM, Disk, and network bandwidth spare.
The UFs appear to be turning over connections more often than I'd expect.
Any suggestions? Should I be able to get more than 500 inbound 9997 connections on my indexers?
↧
