https://community.splunk.com/t5/Getting-Data-In/Why-is-my-WinEventLog-collection-process-slow/m-p/341337#M62907 <P>Hi All, </P> <P>I've been thinking for some time that I am not getting the performance I should be out of my Splunk setup and I'd like some advice for troubleshooting.</P> <P>Currently, I have a single Search Head, which is searching across two Indexers (non-clustered) and a few Universal Forwarders.</P> <P>They are all VMs, but with 4vCPUs and 10GB RAM and are idle most of the time. Forgetting the complete setup for now, I am focusing on a test which involved me stopping the services on Indexer 1 and clearing the indexes on it, including the fishbuket index. </P> <P>I have three inputs for Event Logs; <BR /> - Application log going to an 'application' index<BR /> - Security log going to a 'security' index<BR /> - System log going to a 'system' index</P> <P>All indexes are defined in the indexes.conf</P> <P>I have configued the inputs.conf to collect local event logs on Indexer 1, so when I restart the services I expect it to start filling up the three indexes I have defined from the local Event Logs of the same name. This does happen, but <EM>really</EM> slowly - I think it Indexed about 300 Event Logs in 45 minutes. </P> <P>Does anyone have any idea why this would be slow and how I might troubleshoot it? </P> <P>Many thanks! </P> <P>M</P> Wed, 31 Jan 2018 16:19:35 GMT mshilston 2018-01-31T16:19:35Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-WinEventLog-collection-process-slow/m-p/341337#M62907 <P>Hi All, </P> <P>I've been thinking for some time that I am not getting the performance I should be out of my Splunk setup and I'd like some advice for troubleshooting.</P> <P>Currently, I have a single Search Head, which is searching across two Indexers (non-clustered) and a few Universal Forwarders.</P> <P>They are all VMs, but with 4vCPUs and 10GB RAM and are idle most of the time. Forgetting the complete setup for now, I am focusing on a test which involved me stopping the services on Indexer 1 and clearing the indexes on it, including the fishbuket index. </P> <P>I have three inputs for Event Logs; <BR /> - Application log going to an 'application' index<BR /> - Security log going to a 'security' index<BR /> - System log going to a 'system' index</P> <P>All indexes are defined in the indexes.conf</P> <P>I have configued the inputs.conf to collect local event logs on Indexer 1, so when I restart the services I expect it to start filling up the three indexes I have defined from the local Event Logs of the same name. This does happen, but <EM>really</EM> slowly - I think it Indexed about 300 Event Logs in 45 minutes. </P> <P>Does anyone have any idea why this would be slow and how I might troubleshoot it? </P> <P>Many thanks! </P> <P>M</P> Wed, 31 Jan 2018 16:19:35 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-WinEventLog-collection-process-slow/m-p/341337#M62907 mshilston 2018-01-31T16:19:35Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-WinEventLog-collection-process-slow/m-p/341338#M62908 <P>OK, so after digging around it appears that it was indexing correctly, just that it wasn't re-reading old event logs due to the following files being present;</P> <P>$SPLUNK_HOME\var\lib\splunk\modinputs\WinEventLog\</P> <P>Once I cleared these out everything started working as expected <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 01 Feb 2018 09:38:27 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-WinEventLog-collection-process-slow/m-p/341338#M62908 mshilston 2018-02-01T09:38:27Z