What is needed to ensure that high-velocity sources will not have forwarding delays to the indexers?

Question

Options

• AIncrease the default value of sessionTimeout in server, conf.
• BIncrease the default limit for maxKBps in limits.conf.
• CDecrease the value of forceTimebasedAutoLB in outputs. conf.
• DDecrease the default value of phoneHomelntervallnSecs in deploymentclient .conf.

• A
  10% (2)
• B
  81% (17)
• C
  5% (1)
• D
  5% (1)

Explanation

To ensure that high-velocity sources will not have forwarding delays to the indexers, the default limit for maxKBps in limits.conf should be increased. This parameter controls the maximum bandwidth that a forwarder can use to send data to the indexers. By default, it is set to 256 KBps, which may not be sufficient for high-volume data sources. Increasing this limit can reduce the forwarding latency and improve the performance of the forwarders. However, this should be done with caution, as it may affect the network bandwidth and the indexer load. Option B is the correct answer. Option A is incorrect because the sessionTimeout parameter in server.conf controls the duration of a TCP connection between a forwarder and an indexer, not the bandwidth limit. Option C is incorrect because the forceTimebasedAutoLB parameter in outputs.conf controls the frequency of load balancing among the indexers, not the bandwidth limit. Option D is incorrect because the phoneHomelntervallnSecs parameter in deploymentclient.conf controls the interval at which a forwarder contacts the deployment server, not the bandwidth limit12 1: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Limitsconf#limits.conf.spec 2: https://docs.splunk.com/Documentation/Splunk/9.1.2/Forwarding/Routeandfilterdatad#Set_the_m aximum_bandwidth_usage_for_a_forwarder

No community discussion yet for this question.