Best Practice for index configuration consisting of millions of small events (syslog)

Esky73 — Thu, 27 Jul 2017 07:02:12 GMT

We are ingesting syslog which has approximately 2.5 million events every 15 mins.

Are there any best practices or recommendations to optimise the index\buckets in this scenario

thx

Re: Best Practice for index configuration consisting of millions of small events (syslog)

koshyk — Thu, 27 Jul 2017 09:08:31 GMT

I hope your question is related to Splunk indexing and NOT configuration for syslog?
some of the practices we follow

Ensure syslog logs in a consistent directory structure. So the template should be fine tuned to create a good hierarchy structure. eg /data/syslog/$port/$ip-host/$facility.$priority.log
Ensure logrotate is enabled to rotate these logs after a time or size. Ensure delaycompress option is enabled
Based on naming convention or IP ranges, your Splunk inputs should collect and assign correct sourcetype at collection itself (eg: /data/syslog/514/my-cisco-device/kern.info.log should be assigned the relevant sourcetype, source, index, host at collection time)
The index and indextime fields should be already present in your indexes/props for correct data indexing. (eg create mycompany_network index for network-data and props should align to the CIM model fields if possible)
if you use multiple syslog servers, ensure no duplication happens on the data
our experience shows with Splunk recommended indexers x 4, we can collect and index about your number without any impact to searches.