All Apps and Add-ons

database Splunk

klychnikov
Explorer

Not found information about the database which stores data Splunk. Is it possible to use SQL as the database data where the data is stored Splunk?

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

No; Splunk's "database" backend is proprietary, and can't be tied to some other storage. If capacity is an issue, you might consider the Shuttl app.

sowings
Splunk Employee
Splunk Employee

There are Splunk users who index terabytes of data per day. Indexes don't have a fixed size, but an underlying bucket (the subdivision of an index) does have a max size, see indexes.conf. Events per second is dictated by your hardware, and the number of indexers involved. See here for more information.

klychnikov
Explorer

What are the restrictions on the maximum size of the database?
What is the maximum number of events per second, which can take Splunk? For example, SSIM 8000 events per second.

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...