topic Re: Can Splunk forwarder will forward data at high speed in Getting Data In

Can Splunk forwarder will forward data at high speed

x05311 — Fri, 07 Apr 2017 15:48:00 GMT

Hi All,

I've report server, which producing log data in "report.log" file, the max size of report.log is 10MB and it will create versions.
some time my report server writing data at 10 MB/s if my splunk forwarder is not forwarding at this rate i will loose data bcz it will create new versions.

my question : Splunk can forward at 10 MB/s if YES what hardware required.

Pls advise me

Re: Can Splunk forwarder will forward data at high speed

somesoni2 — Fri, 07 Apr 2017 16:02:03 GMT

Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.

https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.html
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html

Re: Can Splunk forwarder will forward data at high speed

x05311 — Fri, 07 Apr 2017 16:12:09 GMT

Thanks Thanks

Re: Can Splunk forwarder will forward data at high speed

Richfez — Fri, 07 Apr 2017 16:42:29 GMT

This sounds like it answered your question , x05311. I have converted it to an Answer, so if it was the answer you were looking for could you please mark this as accepted?

Thanks!

-Rich