topic HEC Appender logging slow in Splunk Dev

HEC Appender logging slow

kombi — Sat, 18 May 2024 02:35:47 GMT

Logging a single line to Splunk is taking about 30ms with the HEC appender.

e.g, the result of the below is 30ms.

Long start1 = System.currentTimeMillis(); log.info("Test logging"); Long start2 = System.currentTimeMillis(); log.info("logTime={}", start2 - start1);

This is our logback config -

Taking 30 ms is too long for a single log action. Are we missing anything in the config ?

Re: HEC Appender logging slow

PickleRick — Sat, 18 May 2024 05:47:06 GMT

What do you mean by "takes 30ms"? Measured how - from when till when?

Did you do a tcpdump to check packets timeline?

Did you test just a single event or pushed in batch?

Re: HEC Appender logging slow

kombi — Mon, 20 May 2024 02:13:36 GMT

Hi,

We re measuring with a code snippet like the below, the time before we called the logger subtract the time the logger completed.

Long start1 = System.currentTimeMillis(); 
log.info("Test logging"); 
Long start2 = System.currentTimeMillis(); 
log.info("logTime={}", start2 - start1);

We have not use a tcpdump yet as this is running on a container, not able to use batch too since we needed type=raw which don't support batch configs from my understanding. Is there a way to work with Raw type and send as batch?

Thanks.