noobie questions: How frequently does splunk index incoming updates (event logs) from forwarder. n other workds what are the Default settings for index refresh.
Also on the forwarder, i read from these Q&A pages that there is no way to batch the events (e.g. in windows event logs) on the forwarding server (Where forwarder is installed) such that i can send the events when a certain threshold (file size/event counter) is reached - any update will be captured by the forwarder and sent to the splunk server (correct?) So network essentially on the forwarding side caps my throughput.
If you are talking about the monitor stanza (where you monitor a particular file or directory) the default is 3 seconds. This is set on the forwarder side, not the indexer. The attribute is called "timebeforeclose" and can be found in inputs.conf. This attribute tells your forwarder to keep a file open for 3 seconds after it sees an update before sending it to the indexer.
If you are asking about any other stanza, there are attributes like "interval", that you can define to tell your forwarder exactly how often you want to send data.
Take a look in the inputs.conf.spec.
Hope this helps.
How frequently does splunk index incoming updates (event logs) from forwarder.
The indexer will proceed with any data received Immediately.