In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

When useACK is set to true in outputs.conf, Splunk provisions a wait queue that is exactly 3 times the maxQueueSize to buffer events pending acknowledgment from the receiving indexer. With maxQueueSize=7MB, the resulting wait queue is 3 x 7MB = 21MB.

28MB would imply a 4x multiplier for the wait queue, but Splunk's documented behavior uses a fixed 3x multiplier when useACK is enabled.

14MB would imply a 2x multiplier, but the wait queue is always 3x the maxQueueSize when useACK is set to true.

7MB would mean no additional queue capacity is allocated beyond maxQueueSize, but enabling useACK requires a separate wait queue equal to 3x maxQueueSize.