topic Bandwith between SearchHeads and ClusterPeers in Splunk Search

Bandwith between SearchHeads and ClusterPeers

salem34 — Thu, 27 Jan 2022 07:50:50 GMT

Hi Folks

Is there a way to analyze the bandwith used between the SearchHeads and the indexer cluster peers?

I know this has many dependencies on the search and its artifacts but we do need to have a rough calculation to size the environment.

Any help is appreciated.

Cheers, Claudio

Re: Bandwith between SearchHeads and ClusterPeers

richgalloway — Thu, 27 Jan 2022 13:12:35 GMT

Splunk recommends a 1GB ethernet interface. Any estimate beyond would be wild speculation given what we know about your environment.

Re: Bandwith between SearchHeads and ClusterPeers

salem34 — Thu, 27 Jan 2022 13:43:17 GMT

The question is whether there is a way to report on the used bandwith using splunk logs-

Re: Bandwith between SearchHeads and ClusterPeers

richgalloway — Thu, 27 Jan 2022 19:29:22 GMT

I misunderstood the question and thought you wanted to estimate the network usage prior to installing Splunk.

For an existing environment, the best answer probably will come from your Network team. They should have the tools to fairly accurately measure the data flow between Splunk instances.

Other than that, I think you'll be stuck trying to find the information from Splunk. There are metrics on the amount of data ingested, but little on the amount of data sent between instances.