Splunk Logging Driver for Docker Max Buffer

When using the Splunk Logging Driver for Docker, you can leverage SPLUNK_LOGGING_DRIVER_BUFFER_MAX to set the maximum number of messages held in buffer for retries. The default is 10 * 1000 but can anyone confirm the maximum value that can be set?

I don’t think there is a maximum value, but since it is held in memory, you wouldn’t want to set it to a very large value. Here is the relevant source code if you are interested:

If the network and the splunk endpoint works, you don’t need a lot of logs in the buffer. There is a batch size which controls how many logs has to be collected before sending it to splunk, so the logs won’t be sent one by one anyway.

Thank you! The customer is interested in understanding max size in the event the network fails. This is helpful. These would sit in-memory on the container which would be the largest cost implication to storing many logs, correct?

Logging drivers are not running in the container, only reading the standard output and standard error streams of it. The default driver saves the read logs to json, other drivers send it to somewhere else. But the rest is true. Since the buffer is a variable and the content of variables are in the memory, the logs are kept in memory. Unless there is something in GoLang I don’t know about.