Getting Data In

Aggregating WinEventLogs from 2,000 XP machines, total daily volume 20GB

garfieldconnoll
Explorer

Hi,

So we've 2,000 XP machines generating c.20GB of WinEventLogs. For compliance reasons, we want to log it centrally.

We're considering using universal forwarders on each machine and then using 2- 4 intermediate forwarders to aggregate onto a single indexer.

I've read else where about suggested max ratio of 1000: 1 forwarders to indexer and even of an example of 6000:1 in a similar use case.

If we do use intermediate forwards, what sort of spec should we look at?

Thanks,

G.

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You don't need intermediate forwarders. Go directly to the indexers. I don't know where you're reading about this, but there is no Splunk limit anywhere near as low as 1000 or even 6000 forwarders to an indexer. (The server OS or network settings, however, may have limits configured in that may have to be found and lifted.)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You don't need intermediate forwarders. Go directly to the indexers. I don't know where you're reading about this, but there is no Splunk limit anywhere near as low as 1000 or even 6000 forwarders to an indexer. (The server OS or network settings, however, may have limits configured in that may have to be found and lifted.)

garfieldconnoll
Explorer

Thanks for the prompt response. Not sure where I found the 1000 reference, but the 6000 example came from here on Answers.
Would a single deployment server be sufficient (if we set the phone home function to 600- 1200 seconds)?

Regards,

G.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...