Deployment Architecture

Slow HEC server ingestion thruput

hrawat_splunk
Splunk Employee
Splunk Employee

Also <protocol>://<host>:8088/services/collector/health timing out.

Labels (1)
Tags (1)
0 Karma
1 Solution

hrawat_splunk
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

View solution in original post

hrawat_splunk
Splunk Employee
Splunk Employee

This issue single threaded HEC server( not honoring dedicatedIoThreads) is resolved by 8.1.7 and above, 8.2.4 and above, 9.0.x

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

Correction: Only 8.1.x and 8.2.x so far has single threaded HEC receiver.  8.0.x is not impacted by dedicatedIoThreads regression.

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

Version 8.1.x and 8.2.x so far has single threaded HEC receiver.  The reason for that is dedicatedIoThreads config in inputs.conf is ignored. 

dedicatedIoThreads = <integer>

 Until it get's restored in 8.2.4, you may want to stay on latest 7.3.x/8.0.x version for HEC receiver.

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...