https://community.splunk.com/t5/Monitoring-Splunk/HEC-Collector-Cluster-Measuring-Performance/m-p/500564#M4139 <P>Hello @amat</P> <P>not quite what you asked: you can measure the indexing performance which includes HEC Collector latency. You can do this:</P> <UL> <LI>directly with metrics data or as diff between _indextime and _time</LI> <LI>using Monitoring Console (MC)</LI> </UL> <P>Before you add more HEC Collectors, try to tune your setup:</P> <UL> <LI><A href="https://conf.splunk.com/files/2017/slides/measuring-hec-performance-for-fun-and-profit.pdf">https://conf.splunk.com/files/2017/slides/measuring-hec-performance-for-fun-and-profit.pdf</A></LI> <LI><A href="https://www.splunk.com/en_us/blog/tips-and-tricks/turbo-charging-modular-inputs-with-the-hec-http-event-collector-input.html">https://www.splunk.com/en_us/blog/tips-and-tricks/turbo-charging-modular-inputs-with-the-hec-http-event-collector-input.html</A></LI> </UL> Mon, 18 May 2020 16:02:05 GMT PavelP 2020-05-18T16:02:05Z https://community.splunk.com/t5/Monitoring-Splunk/HEC-Collector-Cluster-Measuring-Performance/m-p/500563#M4138 <P>I've been looking around how to measure and scale a Splunk HEC Collector cluster, but I cant seem to find direct answers.</P> <P>I am trying to find a way to measure the performance of a HEC Collector and how to determine when a HEC Collector cluster needs to be scaled to accommodate more/less HEC requests. I understand that EPS ( events per second) can be measured but how does one determine if that number is too high or too low?</P> <P>Currently, i have two Heavyforwarders that are acting as HEC Collectors behind a load balancer. I am trying to find out a good way to determine if this is enough or if another member needs to be added.</P> <P>Appreciate the help!</P> Fri, 05 Jun 2020 22:53:56 GMT https://community.splunk.com/t5/Monitoring-Splunk/HEC-Collector-Cluster-Measuring-Performance/m-p/500563#M4138 amat 2020-06-05T22:53:56Z https://community.splunk.com/t5/Monitoring-Splunk/HEC-Collector-Cluster-Measuring-Performance/m-p/500564#M4139 <P>Hello @amat</P> <P>not quite what you asked: you can measure the indexing performance which includes HEC Collector latency. You can do this:</P> <UL> <LI>directly with metrics data or as diff between _indextime and _time</LI> <LI>using Monitoring Console (MC)</LI> </UL> <P>Before you add more HEC Collectors, try to tune your setup:</P> <UL> <LI><A href="https://conf.splunk.com/files/2017/slides/measuring-hec-performance-for-fun-and-profit.pdf">https://conf.splunk.com/files/2017/slides/measuring-hec-performance-for-fun-and-profit.pdf</A></LI> <LI><A href="https://www.splunk.com/en_us/blog/tips-and-tricks/turbo-charging-modular-inputs-with-the-hec-http-event-collector-input.html">https://www.splunk.com/en_us/blog/tips-and-tricks/turbo-charging-modular-inputs-with-the-hec-http-event-collector-input.html</A></LI> </UL> Mon, 18 May 2020 16:02:05 GMT https://community.splunk.com/t5/Monitoring-Splunk/HEC-Collector-Cluster-Measuring-Performance/m-p/500564#M4139 PavelP 2020-05-18T16:02:05Z