Change to 3000ms to allow for fuller batches

* Change to 3000ms to allow for fuller batches; preference is for full batches over latency
CSVD · Jan 20, 2020 · 03aff7d · 03aff7d
1 parent ba1d03f
commit 03aff7d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/package/etc/conf.d/destinations/splunk_hec.conf.tmpl b/package/etc/conf.d/destinations/splunk_hec.conf.tmpl
@@ -6,7 +6,7 @@ destination d_hec {
          workers({{- getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10"}})
          batch-lines({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_LINES" "1000"}})
          batch-bytes({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_BYTES" "4096kb"}})
-         batch-timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT" "1000"}})
+         batch-timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT" "3000"}})
          timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_TIMEOUT" "30"}})
          user_agent("sc4s/1.0 (events)")
          user("sc4s")
@@ -45,4 +45,4 @@ destination d_hec {
                  event="$MSG"
                  fields.*)')
         );
-};
+};