All Apps and Add-ons
Highlighted

database Splunk

Explorer

Not found information about the database which stores data Splunk. Is it possible to use SQL as the database data where the data is stored Splunk?

Tags (1)
0 Karma
Highlighted

Re: database Splunk

Splunk Employee
Splunk Employee

No; Splunk's "database" backend is proprietary, and can't be tied to some other storage. If capacity is an issue, you might consider the Shuttl app.

Highlighted

Re: database Splunk

Explorer

What are the restrictions on the maximum size of the database?
What is the maximum number of events per second, which can take Splunk? For example, SSIM 8000 events per second.

0 Karma
Highlighted

Re: database Splunk

Splunk Employee
Splunk Employee

There are Splunk users who index terabytes of data per day. Indexes don't have a fixed size, but an underlying bucket (the subdivision of an index) does have a max size, see indexes.conf. Events per second is dictated by your hardware, and the number of indexers involved. See here for more information.