topic Re: Initial stage of Splunk performance tunning in All Apps and Add-ons

Initial stage of Splunk performance tunning

rreddy012c — Sat, 26 Aug 2017 16:11:47 GMT

We have deployed our splunk in our organization. We are currently ingesting 1.7 TB data per day and it can increase up to 3.5 TB. We are using high performance hardware resources for splunk.
Now I would like to know what would be the better tuning memory parameters which need to set for SH/Indexer to increase the performance? Otherthan memory do we need to look into any other settings?

Re: Initial stage of Splunk performance tunning

skoelpin — Sat, 26 Aug 2017 18:21:42 GMT

Depending on the specs of your indexers, you could enable parallelization to increase throughput

http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/Parallelization

Re: Initial stage of Splunk performance tunning

rreddy012c — Sat, 26 Aug 2017 18:50:35 GMT

Thanks for suggestion and How memory does splunk allocates for each search?

Re: Initial stage of Splunk performance tunning

skoelpin — Sat, 26 Aug 2017 21:30:06 GMT

Splunk cares more about CPU cores than memory. A rule of thumb is each concurrent search represents approx 1 CPU core. This is configurable though

http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/Referencehardware

Re: Initial stage of Splunk performance tunning

ddrillic — Sun, 27 Aug 2017 01:44:59 GMT

Many many aspects are involved. The following can assist - Optimize Splunk for peak performance