All Apps and Add-ons

Kafka Messaging Modular Input: How to set up multiple heavy forwarder agents on the same server to pull from the same Kafka topic?

pcressy
Engager

I tried to set up multiple heavy forwarder agents on the same server pulling from a Kafka topic, but it appeared as if only one agent would take any load (I was monitoring agent via top cmd, java cpu load, maybe there is a better method, say via index=_internal?). I've done a similar thing with jms with success, but I wasn't able to get past 300 tps. I haven't tried the same thing over multiple servers yet, but I'm wondering if there is a obvious setting, maybe in the inputs.conf that I need to modify.

0 Karma

Damien_Dallimor
Ultra Champion

What does your Kafka configuration (from inputs.conf) look like ?

Also, try the latest release of the Kafka Mod Input.It should perform better with the new HEC output option.

http://blogs.splunk.com/2015/09/22/turbo-charging-modular-inputs-with-the-hec-http-event-collector-i...

0 Karma

pcressy
Engager

Thanks for the reply I'll try 8.1
here is the inputs.conf I'm currently using
[kafka://tsys_kafka_10.xxxx]
group_id = splunk
index = tsys
sourcetype = tsys_kafka
topic_name = splunk_auth_stream
zookeeper_connect_host = 10.xxxx
zookeeper_connect_port = 2181

[kafka://tsys_kafka_10.xxxx]
group_id = splunk
index = tsys
sourcetype = tsys_kafka
topic_name = splunk_auth_stream
zookeeper_connect_host = 10.xxx
zookeeper_connect_port = 2181

[kafka://tsys_kafka_10.xxxxx]
group_id = splunk
index = tsys
sourcetype = tsys_kafka
topic_name = splunk_auth_stream
zookeeper_connect_host = 10.xxxx
zookeeper_connect_port = 2181

0 Karma

pcressy
Engager

Thanks for the reply I'll try 8.1.
Here is the inputs.conf I'm currently using:

[kafka://tsys_kafka_10.xxxx]
group_id = splunk
index = tsys
sourcetype = tsys_kafka
topic_name = splunk_auth_stream
zookeeper_connect_host = 10.xxxx
zookeeper_connect_port = 2181

[kafka://tsys_kafka_10.xxxx]
group_id = splunk
index = tsys
sourcetype = tsys_kafka
topic_name = splunk_auth_stream
zookeeper_connect_host = 10.xxx
zookeeper_connect_port = 2181

[kafka://tsys_kafka_10.xxxxx]
group_id = splunk
index = tsys
sourcetype = tsys_kafka
topic_name = splunk_auth_stream
zookeeper_connect_host = 10.xxxx
zookeeper_connect_port = 2181
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...