https://community.splunk.com/t5/Getting-Data-In/UF-to-HF-ratio/m-p/84004#M17464 <P>From the field...... customers with large deployments, what is your ratio of UFs to HFs. We had about 2500 UFs reporting to 2 HFs (one had a dual role HF/DS). We now have 3 dedicated HFs. We will eventually have about 10k UFs reporting to the 3 HFs. From field experience - does this ratio sound ok? If not, what should the ratio be? I know hardware can make a difference, but I am really concerned with the max established connections.</P> Thu, 10 Jan 2013 16:59:44 GMT mcbradford 2013-01-10T16:59:44Z https://community.splunk.com/t5/Getting-Data-In/UF-to-HF-ratio/m-p/84004#M17464 <P>From the field...... customers with large deployments, what is your ratio of UFs to HFs. We had about 2500 UFs reporting to 2 HFs (one had a dual role HF/DS). We now have 3 dedicated HFs. We will eventually have about 10k UFs reporting to the 3 HFs. From field experience - does this ratio sound ok? If not, what should the ratio be? I know hardware can make a difference, but I am really concerned with the max established connections.</P> Thu, 10 Jan 2013 16:59:44 GMT https://community.splunk.com/t5/Getting-Data-In/UF-to-HF-ratio/m-p/84004#M17464 mcbradford 2013-01-10T16:59:44Z https://community.splunk.com/t5/Getting-Data-In/UF-to-HF-ratio/m-p/84005#M17465 <P>about the number of open connections :</P> <UL> <LI>on linux : make sure that your HF have a large number of file descriptors (see ulimit)</LI> <LI>on windows , who knows.</LI> </UL> <P>About the volume :</P> <UL> <LI>event parsing, the HF do the event parsing, so the format and transforms will impact the performance too. ultimately the cpu load will be on the HF instead of the Indexers. </LI> <LI>the volume will impact the performance, what is your volume ? Usually a single indexing server is expected to handle an average 50GB per day</LI> </UL> Thu, 10 Jan 2013 18:06:22 GMT https://community.splunk.com/t5/Getting-Data-In/UF-to-HF-ratio/m-p/84005#M17465 yannK 2013-01-10T18:06:22Z