https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-Splunk-SE-impact-existing-infrastructure-performance/m-p/552198#M9934 <P>Are you referring to the Security Essentials (SE) app or the Enterprise Security (ES) app?&nbsp; The question mentions the former, but it's in the ES forum.</P><P>Neither app ingests any data as they both simply use the data that's already ingested.</P><P>There is no specific answer to the question because the performance will depend on how you use the app.&nbsp; The more searches you run the more performance will be impacted.</P><P>ES is a known resource hog.&nbsp; That's why Splunk recommends it be installed on a dedicated search head.</P><P>As for how to get a better view of the performance situation, use the same techniques you use to monitor the performance of any of your servers.&nbsp; For a more specific answer, ask a more specific question.</P><P>&nbsp;</P> Wed, 19 May 2021 12:30:22 GMT richgalloway 2021-05-19T12:30:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-Splunk-SE-impact-existing-infrastructure-performance/m-p/552188#M9933 <P>Hello,</P><P>I have been searching for hours but I have yet to come across to an answer to my question:</P><P>- How does Splunk SE impact the performance of my existing infrastructure since it will ingest and process a lot of data? (I'm talking CPU performance of switches, virtual machines etc. and general bandwith)</P><P>&nbsp;</P><P>If there's a general answer to this question then please let me know. If there's a specific answer to this question and lots more information is needed: Which steps can my organization undertake to get a better view of the performance situation?</P><P>Thanks!</P> Wed, 19 May 2021 11:30:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-Splunk-SE-impact-existing-infrastructure-performance/m-p/552188#M9933 ITAdminBart 2021-05-19T11:30:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-Splunk-SE-impact-existing-infrastructure-performance/m-p/552198#M9934 <P>Are you referring to the Security Essentials (SE) app or the Enterprise Security (ES) app?&nbsp; The question mentions the former, but it's in the ES forum.</P><P>Neither app ingests any data as they both simply use the data that's already ingested.</P><P>There is no specific answer to the question because the performance will depend on how you use the app.&nbsp; The more searches you run the more performance will be impacted.</P><P>ES is a known resource hog.&nbsp; That's why Splunk recommends it be installed on a dedicated search head.</P><P>As for how to get a better view of the performance situation, use the same techniques you use to monitor the performance of any of your servers.&nbsp; For a more specific answer, ask a more specific question.</P><P>&nbsp;</P> Wed, 19 May 2021 12:30:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-Splunk-SE-impact-existing-infrastructure-performance/m-p/552198#M9934 richgalloway 2021-05-19T12:30:22Z