All Apps and Add-ons

database Splunk

klychnikov
Explorer

Not found information about the database which stores data Splunk. Is it possible to use SQL as the database data where the data is stored Splunk?

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

No; Splunk's "database" backend is proprietary, and can't be tied to some other storage. If capacity is an issue, you might consider the Shuttl app.

sowings
Splunk Employee
Splunk Employee

There are Splunk users who index terabytes of data per day. Indexes don't have a fixed size, but an underlying bucket (the subdivision of an index) does have a max size, see indexes.conf. Events per second is dictated by your hardware, and the number of indexers involved. See here for more information.

klychnikov
Explorer

What are the restrictions on the maximum size of the database?
What is the maximum number of events per second, which can take Splunk? For example, SSIM 8000 events per second.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...