topic Re: Using a Splunk Forwarder versus adding the data from a network drive in Getting Data In

Using a Splunk Forwarder versus adding the data from a network drive

paduka — Thu, 11 Aug 2016 07:59:36 GMT

Hi,

I am facing some performance challenges and hence wanted to get clarification on a few things. I have data sitting on two drives. I am indexing this data on Splunk. I have currently added these two mount drives as network drive on my computer and added the inputs locally on the indexer.

However, another solution could be to forward the data from these two locations, using an universal forwarder, to the indexer machine.

Since, our system performance is really slow with a distributed setup of an indexer and a searchhead. I want to know if using forwarders has a performance advantage over adding data by adding the network drives.

Thanks!

Re: Using a Splunk Forwarder versus adding the data from a network drive

gcusello — Thu, 11 Aug 2016 08:33:32 GMT

Sure, because Splunk Universal forwarder optimize and compress data before send them to the Indexer.
In addition, you can configure a network bandwidth value so you don't fill your network.
see:
- http://blogs.splunk.com/2011/10/24/choosing-a-forwarder-or-not/
- http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/useforwarders

Bye.
Giuseppe

Re: Using a Splunk Forwarder versus adding the data from a network drive

TStrauch — Thu, 11 Aug 2016 08:40:32 GMT

Hi,

simple answer. No.

Until there are no restrictions in your networksegements and you can add the mount the drives without problems you can just do that. Using a forwarder at this point will not give you any performance advantages.

Of course there are advantages of using forwarders espacially on big infrastructures, but thats not a part of the answer to your question.

Kind regards

Re: Using a Splunk Forwarder versus adding the data from a network drive

gcusello — Fri, 09 Sep 2016 11:18:11 GMT

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe