noobie questions: How frequently does splunk index incoming update from forwarder?

[reviewphile]

noobie questions: How frequently does splunk index incoming updates (event logs) from forwarder. n other workds what are the Default settings for index refresh.

Also on the forwarder, i read from these Q&A pages that there is no way to batch the events (e.g. in windows event logs) on the forwarding server (Where forwarder is installed) such that i can send the events when a certain threshold (file size/event counter) is reached - any update will be captured by the forwarder and sent to the splunk server (correct?) So network essentially on the forwarding side caps my throughput.

[yannK]

How frequently does splunk index incoming updates (event logs) from forwarder.

The indexer will proceed with any data received Immediately.

• If the indexer happen to be too busy (queues blocked or full), it will tell the forwarders to stop sending data (and pause monitoring).
• On the forwarder side, the limit is usually the default thruput ( see limits.conf) or the number of inputs/file to collect that can delay the monitoring.

[aholzer]

If you are talking about the monitor stanza (where you monitor a particular file or directory) the default is 3 seconds. This is set on the forwarder side, not the indexer. The attribute is called "time_before_close" and can be found in inputs.conf. This attribute tells your forwarder to keep a file open for 3 seconds after it sees an update before sending it to the indexer.

If you are asking about any other stanza, there are attributes like "interval", that you can define to tell your forwarder exactly how often you want to send data.

Take a look in the inputs.conf.spec.

Hope this helps.