Hi Splunk community,
we have an Heavy Forwarder which mostly ingests syslog data via tcp. The volume of ingested data is rather constant.
In order to check whether we could get could more performance we disabled useACK in the outputs.conf of the HF.
We were quite surprised that instead of increasing throughput by saving overhead, we observed a sharp drop in ingestion, including events from the internal logs of the Heavy Forwarder![alt text][1].
We went back enabling acknowledgement after an hour.
Can you give us some advice, that could explain this behvaiour?
Could this be a hint, that there's a deeper problem in out Splunk infrastructure that is smoothed out by the acknowledgement feature?
Thanks in advance!
Kindly regards,
Jens Wunder
[1]: /storage/temp/284648-useack.jpg
↧