Dashboards & Visualizations
Highlighted

noobie questions: How frequently does splunk index incoming update from forwarder?

New Member

noobie questions: How frequently does splunk index incoming updates (event logs) from forwarder. n other workds what are the Default settings for index refresh.

Also on the forwarder, i read from these Q&A pages that there is no way to batch the events (e.g. in windows event logs) on the forwarding server (Where forwarder is installed) such that i can send the events when a certain threshold (file size/event counter) is reached - any update will be captured by the forwarder and sent to the splunk server (correct?) So network essentially on the forwarding side caps my throughput.

0 Karma
Highlighted

Re: noobie questions: How frequently does splunk index incoming update from forwarder?

Motivator

If you are talking about the monitor stanza (where you monitor a particular file or directory) the default is 3 seconds. This is set on the forwarder side, not the indexer. The attribute is called "timebeforeclose" and can be found in inputs.conf. This attribute tells your forwarder to keep a file open for 3 seconds after it sees an update before sending it to the indexer.

If you are asking about any other stanza, there are attributes like "interval", that you can define to tell your forwarder exactly how often you want to send data.

Take a look in the inputs.conf.spec.

Hope this helps.

Highlighted

Re: noobie questions: How frequently does splunk index incoming update from forwarder?

Splunk Employee
Splunk Employee

How frequently does splunk index incoming updates (event logs) from forwarder.

The indexer will proceed with any data received Immediately.

  • If the indexer happen to be too busy (queues blocked or full), it will tell the forwarders to stop sending data (and pause monitoring).
  • On the forwarder side, the limit is usually the default thruput ( see limits.conf) or the number of inputs/file to collect that can delay the monitoring.
0 Karma