https://community.splunk.com/t5/Splunk-Search/How-to-set-gather-Performance-benchmark-for-splunk/m-p/294259#M166401 <P>Assuming that Splunk is installed as per the recommended reference architecture and hardware, then based on real-world performance in other customers what are the Splunk benchmarks for the following metrics (assuming 5-10 GB data ingestion per day) </P> <PRE><CODE>- Latency [i.e., how long would it take from the point an event is generated to the time it is available for searching / alerting] - Search query response times [i.e., what would be the typical range of wait times before the search result is available] - Data reliability [i.e., what is typically the percentage of data transmitted from source systems that is successfully indexed] - Data integrity [i,e search results should be uniform , it should not change for the same time range when executed later] </CODE></PRE> <P>Is there any standard numbers given offcially by splunk when their standard infra requirements is followed ?</P> Fri, 18 Aug 2017 09:50:41 GMT xbbj3nj 2017-08-18T09:50:41Z https://community.splunk.com/t5/Splunk-Search/How-to-set-gather-Performance-benchmark-for-splunk/m-p/294259#M166401 <P>Assuming that Splunk is installed as per the recommended reference architecture and hardware, then based on real-world performance in other customers what are the Splunk benchmarks for the following metrics (assuming 5-10 GB data ingestion per day) </P> <PRE><CODE>- Latency [i.e., how long would it take from the point an event is generated to the time it is available for searching / alerting] - Search query response times [i.e., what would be the typical range of wait times before the search result is available] - Data reliability [i.e., what is typically the percentage of data transmitted from source systems that is successfully indexed] - Data integrity [i,e search results should be uniform , it should not change for the same time range when executed later] </CODE></PRE> <P>Is there any standard numbers given offcially by splunk when their standard infra requirements is followed ?</P> Fri, 18 Aug 2017 09:50:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-gather-Performance-benchmark-for-splunk/m-p/294259#M166401 xbbj3nj 2017-08-18T09:50:41Z https://community.splunk.com/t5/Splunk-Search/How-to-set-gather-Performance-benchmark-for-splunk/m-p/294260#M166402 <P>here is a non complete answer.<BR /> as far as i know, there are no documented benchmarks as there are many variables. as for your points:<BR /> 1. depends on how long it takes it to arrive to the indexer, network latency, other metrics, etc. you can measure it by comparing the _time field (time of event) to _indextime field (time when event was indexed)<BR /> 2. Search Query, this is really depends on your search. it also depends on the load the Search Head is under.<BR /> 3. Data reliability, depends how you bring data in, TCP, UDP, API call etc. check answers here regarding "how can i really know all my events are in splunk?"<BR /> 4. this is very accurate, for the same time range and search query, you will recive the exact same results.<BR /> hope it helps</P> Fri, 18 Aug 2017 11:52:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-gather-Performance-benchmark-for-splunk/m-p/294260#M166402 adonio 2017-08-18T11:52:37Z