Deployment Architecture

Slow HEC server ingestion thruput

hrawat
Splunk Employee
Splunk Employee

Also <protocol>://<host>:8088/services/collector/health timing out.

Tags (1)
0 Karma
1 Solution

hrawat
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

View solution in original post

hrawat
Splunk Employee
Splunk Employee

This issue single threaded HEC server( not honoring dedicatedIoThreads) is resolved by 8.1.7 and above, 8.2.4 and above, 9.0.x

0 Karma

hrawat
Splunk Employee
Splunk Employee

Correction: Only 8.1.x and 8.2.x so far has single threaded HEC receiver.  8.0.x is not impacted by dedicatedIoThreads regression.

0 Karma

hrawat
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...