Which file is edited to change the maximum size of the data wait queue on a forwarder?

The maximum size of the data wait queue on a forwarder is configured in the limits.conf file. This file contains various settings that control the resource limits and behavior of Splunk components, including forwarders. By specifying parameters related to memory and processing limits in limits.conf, administrators can ensure that the forwarder handles data effectively, especially in situations where it is receiving data at a higher rate than it can process. Adjusting the maximum size of the data wait queue is critical for maintaining optimal performance and preventing data loss during peaks in data ingestion.

In contrast, outputs.conf is primarily used to define how and where to send data from the forwarder to the indexer, such as specifying indexer details and load balancing settings. Inputs.conf is focused on defining data input sources for an instance, such as file monitoring or network data collection. Props.conf is used to configure data parsing and indexing rules based on source type, but it does not relate to queue management or resource limits. Thus, selections from these files would not address the specific requirement of adjusting the data wait queue's size.