Splunk Add-on for Cisco IPS: How many Cisco IPS devices/sensors can we add, and how can we find which ones are consuming more resources?

[ppurokit]

What is the max number of Cisco IPS devices/sensors we can add?
I have added 40+ devices, and system became bit slow.
Can we know which thread IPS sensor/Device thread is consuming more resources?
What is the Max log storage supported per Cisco IPS device?

[jcoates_splunk]

I would add them until collection slows down, and then add a second forwarder. We don't have several dozen Cisco IPS's, but in other API-based data collection tasks the slow-down point is somewhere between 10 and 30 devices.

I'd use a search like this to find your connections, then pipe it through transaction, then use stats. You might have to eval to find elapsed time.

index=_internal source=*Splunk_TA_cisco-ips*