https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71792#M180896 <P>There are people who are using hundreds more forwarders than the number you've specified without any issues. As a general rule, I wouldn't say that 30 is too many unless you're having some type of performance problem. In short, I think you're probably just fine with that configuration. </P> Mon, 11 Jun 2012 14:33:45 GMT jbsplunk 2012-06-11T14:33:45Z https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71789#M180893 <P>Hi</P> <P>In our environment ,there are almost 30 servers where splunk forwarders are installed for monitoring and there is only one splunk indexer.I've configured only one receiver for the all 30 forwader servers.Is this the recommended way? or should I split it as a group and configure more receivers?</P> <P>Thanks</P> Mon, 11 Jun 2012 11:33:57 GMT https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71789#M180893 splunker_123 2012-06-11T11:33:57Z https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71790#M180894 <P>Are you experiencing performance issues then?</P> <P>You should look at the following <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdeployment">http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdeployment</A></P> Mon, 11 Jun 2012 11:55:03 GMT https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71790#M180894 MHibbin 2012-06-11T11:55:03Z https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71791#M180895 <P>Hi</P> <P>No,we haven't tested yet..just we are in starting phase.but just wondering is this way of configuration recommended?</P> Mon, 11 Jun 2012 13:54:11 GMT https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71791#M180895 splunker_123 2012-06-11T13:54:11Z https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71792#M180896 <P>There are people who are using hundreds more forwarders than the number you've specified without any issues. As a general rule, I wouldn't say that 30 is too many unless you're having some type of performance problem. In short, I think you're probably just fine with that configuration. </P> Mon, 11 Jun 2012 14:33:45 GMT https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71792#M180896 jbsplunk 2012-06-11T14:33:45Z https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71793#M180897 <P>Did I say 30 ,my bad, it's 70 forwaders actually.I'm sorry<BR /> Do you still think this is going to be fine configuration.?<BR /> I know you said it depends on performance but the point I'm trying to ask is..is there anyone facing some issues with these numbers,if so I dont want to run into issues later?</P> <P>Thanks</P> Mon, 11 Jun 2012 16:18:48 GMT https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71793#M180897 splunker_123 2012-06-11T16:18:48Z https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71794#M180898 <P>70 should be fine as well. Some people have hundreds of forwarders sending data. The question is one of bottlenecks created by the receiving system. Keep in mind that splunk uses a lot of file handlers, and that you need to be able to sustain 800-1000 iops. If the indexer is beefy, and configured properly, you'll be fine.</P> Mon, 11 Jun 2012 16:21:56 GMT https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71794#M180898 jbsplunk 2012-06-11T16:21:56Z https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71795#M180899 <P>ah awesome..thankyou so much</P> Mon, 11 Jun 2012 21:41:51 GMT https://community.splunk.com/t5/Splunk-Search/configuring-receiver/m-p/71795#M180899 splunker_123 2012-06-11T21:41:51Z