database Splunk

[klychnikov]

Not found information about the database which stores data Splunk. Is it possible to use SQL as the database data where the data is stored Splunk?

[sowings]

No; Splunk's "database" backend is proprietary, and can't be tied to some other storage. If capacity is an issue, you might consider the Shuttl app.

[sowings]

There are Splunk users who index terabytes of data per day. Indexes don't have a fixed size, but an underlying bucket (the subdivision of an index) does have a max size, see indexes.conf. Events per second is dictated by your hardware, and the number of indexers involved. See here for more information.

[klychnikov]

What are the restrictions on the maximum size of the database?
What is the maximum number of events per second, which can take Splunk? For example, SSIM 8000 events per second.