topic Re: Splunk Enterprise Flow data indigestion limits in Splunk Search

Splunk Enterprise Flow data indigestion limits

hariskhan — Mon, 07 Jan 2019 08:10:53 GMT

Hi all,

Can some one tell about Network flows indigestion capacity of Splunk enterprise solution.Like how much flows/sec at min and max splunk can accept.

Also any suggestion on receiving flows on separate interface of hardware on which splunk is installed. I mean can a dedicated interface be used on splunk machine to receive network flows?.

Re: Splunk Enterprise Flow data indigestion limits

harsmarvania57 — Mon, 07 Jan 2019 09:26:17 GMT

Hi,

Have look at https://docs.splunk.com/Documentation/Splunk/7.2.3/Capacity/Referencehardware#Maximum_performance_capability , which describes that with reference hardware you can ingest how much data but this depends on many more factors like IOPS, Different custom parsing.

Re: Splunk Enterprise Flow data indigestion limits

hariskhan — Mon, 07 Jan 2019 17:00:20 GMT

I know about this doc. But this doc doesn't mention any limits on how much network flows a base machine or mid range can handle before it can overwhelm the link or machine performance.

Re: Splunk Enterprise Flow data indigestion limits

hariskhan — Mon, 07 Jan 2019 17:04:23 GMT

Am talking about network flows not network syslogs or any device logs. That isi network moving traffic sessions data

Re: Splunk Enterprise Flow data indigestion limits

hariskhan — Wed, 09 Jan 2019 04:41:43 GMT

any update please?.