topic Tuning for performance in Monitoring Splunk

Tuning for performance

halbeisendv — Thu, 26 Jul 2018 20:56:00 GMT

While the Splunk documentation serves us well, I am interested in finding a resource for studying about performance. I have not been successful in locating commercial documentation. Thank you.

Re: Tuning for performance

masonmorales — Thu, 26 Jul 2018 21:56:17 GMT

Here are a few good resources:
https://conf.splunk.com/files/2016/slides/architecting-splunk-for-epic-performance-at-blizzard-entertainment.pdf
https://conf.splunk.com/files/2017/slides/splunk-enterprise-security-health-check.pdf
https://www.rfaircloth.com/2017/12/12/tuning-splunk-when-max-concurrent-searches-are-reached/

Re: Tuning for performance

gjanders — Thu, 26 Jul 2018 23:00:19 GMT

I published a conf talk related to this topic, my talk was more around the "Things I wish I knew then" wiki articles:
How’d You Get So Big? Tips & Tricks for Growing Your Splunk Deployment from 50 GB/Day to 1 TB/Day or recording here

In addition these other talks were excellent resources in addition to the above post:
The Jiffy Lube Quick Tune-‐up For Your Splunk Environment

Also refer to the 2017 conf presentations around Splunk internals and scaling, in particular talks like Worst Practices...and How to Fix Them, the talks on Indexer scaling or 5 million buckets and beyond et cetera, there are many useful talks or documentation around this.

This is all in addition to the capacity planning manual

Re: Tuning for performance

halbeisendv — Tue, 21 Aug 2018 15:15:55 GMT

A great deal of information in this thread; will be working threw it over the next several weeks. Thanks so much.