Splunk Calls for given time period

spampari — Tue, 02 Jan 2024 10:41:54 GMT

Hello Splunk Members,

Need some help on below queries,

-How many calls(read/writing) can we make in Splunk in a given time period(per second)? (Default setting in Splunk. Is it configurable? Max/Min value and how is it caluculated)
-How much data in a given time period? MB/GB? Is it changeable? Min/Max value

-How fast we can make the next insertion? Is there a delay or is it simultaneous? Would this be causing any data loss if there is any connectivity failure or downtime?

when using the Splunk enterprise in general and by using HEC method Is there any difference.

Thanks in Advance for

Re: Splunk Calls for given time period

richgalloway — Tue, 02 Jan 2024 19:19:06 GMT

What do you mean by "calls"? If you mean API calls, there is no limit I know of.

Data retrieval is not limited by time period. Query results are limited in the amount of disk space they can use, with each role having its own configurable limit (100MB is the default). Once the limit is reached, old jobs must be deleted to free up disk space.

Data ingestion is limited only by the power of the indexer(s). The I/O rate of the storage system is a key factor, however. HEC inputs tend to be faster, but have a limit of 1MB per transmission.

Data loss is possible a number of ways. For example, if an indexer goes down and the sender does not retry the transmission then data could be lost. We'll need to know more specifics about your environment to discuss other ways data could be lost.

topic Splunk Calls for given time period in Getting Data In

Splunk Calls for given time period

Re: Splunk Calls for given time period