Deployment Architecture
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

UF parallelization for Splunk Cloud


I'm looking for advice for avoiding the 'Funnel Effect' for a small number of intermediate Universal Forwarders to about 15 cloud indexers - my best lead is to apply parallelization - has anyone had success with that, specifically to the Cloud version?  Are there alternatives?  

Here is a presentation on that issue, where the problem is described at depth but the parallelization solution is only briefly touched upon:

Video -
Presentation -

Thanks for any advice!

Labels (1)
0 Karma


It turns out that there was a change in corporate policy which allows for each of these systems to access the 'outside' network segment, provided a business need could be given, so I'm good to go - thanks!

0 Karma


My advice and (IMO) the best way to avoid the Funnel Effect is to eliminate intermediate forwarders.  Usually, they're unnecessary.  UFs should be sending directly to the cloud indexers.  The network team may complain about too many firewall rules, but that's often just laziness.

If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!