https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-or-Other-Hints-for-Windows-Event-Forwarding/m-p/572678#M101342 <P>We have been using WEF as our collection point for a while.&nbsp; We started out small but have expanded the range of events over time.&nbsp;&nbsp; We have ~5,000 hosts forwarding to a single collector.</P><P>The collector is busy, but seems to be healthy based on conventional Windows indicators.</P><P>However,&nbsp; we have some data loss between the centralized event and Splunk (cloud).&nbsp;&nbsp; Logs show up in the WEF collection log but never make it to the index.</P><P>&nbsp;</P><P>First,&nbsp;&nbsp; are there any performance tuning suggestions you can offer UF on a WEF collector?</P><P>Second,&nbsp; can you think of any way to check on processing of a single event once it goes into the UF and heads to the indexer?</P> Wed, 27 Oct 2021 15:28:16 GMT hughkelley 2021-10-27T15:28:16Z https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-or-Other-Hints-for-Windows-Event-Forwarding/m-p/572678#M101342 <P>We have been using WEF as our collection point for a while.&nbsp; We started out small but have expanded the range of events over time.&nbsp;&nbsp; We have ~5,000 hosts forwarding to a single collector.</P><P>The collector is busy, but seems to be healthy based on conventional Windows indicators.</P><P>However,&nbsp; we have some data loss between the centralized event and Splunk (cloud).&nbsp;&nbsp; Logs show up in the WEF collection log but never make it to the index.</P><P>&nbsp;</P><P>First,&nbsp;&nbsp; are there any performance tuning suggestions you can offer UF on a WEF collector?</P><P>Second,&nbsp; can you think of any way to check on processing of a single event once it goes into the UF and heads to the indexer?</P> Wed, 27 Oct 2021 15:28:16 GMT https://community.splunk.com/t5/Getting-Data-In/Performance-Tuning-or-Other-Hints-for-Windows-Event-Forwarding/m-p/572678#M101342 hughkelley 2021-10-27T15:28:16Z