Deployment Architecture

Slow HEC server ingestion thruput

hrawat
Splunk Employee
Splunk Employee

Also <protocol>://<host>:8088/services/collector/health timing out.

Tags (1)
0 Karma
1 Solution

hrawat
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

View solution in original post

hrawat
Splunk Employee
Splunk Employee

This issue single threaded HEC server( not honoring dedicatedIoThreads) is resolved by 8.1.7 and above, 8.2.4 and above, 9.0.x

0 Karma

hrawat
Splunk Employee
Splunk Employee

Correction: Only 8.1.x and 8.2.x so far has single threaded HEC receiver.  8.0.x is not impacted by dedicatedIoThreads regression.

0 Karma

hrawat
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...