Deployment Architecture

Control bandwidth/network usage for Indexer Cluster Replication

Path Finder

Hi everyone,

I have a requirement from my client to control the bandwidth usage for index replication. He is concerned that the index replication would exceed certain bandwidth that it impacts daily business operation. May I know is there any configuration settings which I can use to mitigate the case for that purpose?

Thanks in advance!

0 Karma

Splunk Employee
Splunk Employee


just to make sure we are talking about the right thing:

100GB/day results in approx 15GB on disk (journal.gz). This data is streamed from the primary peer (indexer) to the secondary peer where it's indexed again (multi site cluster might do things differently).
So... 15GB/day is approx 1/6 megabyte/sec which is approx 1.5 MEGABIT/sec on the wire...

And yes, peeks apply.

Seriously, are we talking about bandwidth control in a datacenter where you have 1-40 GBit/sec?

If you want to tweak the mentioned settings, please involve Splunk PS before you do...



0 Karma


Hi you can try adjusting these parameter in server.conf file but be careful while doing changes:

 max_peer_build_load = <integer>
 * This is the maximum number of concurrent tasks to make buckets
   searchable that can be assigned to a peer.
 * Defaults to 2.

 max_peer_rep_load = <integer>
 * This is the maximum number of concurrent non-streaming
   replications that a peer can take part in as a target.
 * Defaults to 5.

 max_peer_sum_rep_load = <integer>
 * This is the maximum number of concurrent summary replications
   that a peer can take part in as either a target or source.
 * Defaults to 5.
0 Karma


Note that these settings need to be set on the Cluster Master, and a restart. Does not require a push or restart of indexing peers to have new settings take affect.

0 Karma

Path Finder

Hi, thanks for your suggestion, I will try it out. Thanks!

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...