Deployment Architecture

Slow HEC server ingestion thruput

hrawat_splunk
Splunk Employee
Splunk Employee

Also <protocol>://<host>:8088/services/collector/health timing out.

Labels (1)
Tags (1)
0 Karma
1 Solution

hrawat_splunk
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

View solution in original post

hrawat_splunk
Splunk Employee
Splunk Employee

This issue single threaded HEC server( not honoring dedicatedIoThreads) is resolved by 8.1.7 and above, 8.2.4 and above, 9.0.x

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

Correction: Only 8.1.x and 8.2.x so far has single threaded HEC receiver.  8.0.x is not impacted by dedicatedIoThreads regression.

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...