Getting Data In

Aggregating WinEventLogs from 2,000 XP machines, total daily volume 20GB

garfieldconnoll
Explorer

Hi,

So we've 2,000 XP machines generating c.20GB of WinEventLogs. For compliance reasons, we want to log it centrally.

We're considering using universal forwarders on each machine and then using 2- 4 intermediate forwarders to aggregate onto a single indexer.

I've read else where about suggested max ratio of 1000: 1 forwarders to indexer and even of an example of 6000:1 in a similar use case.

If we do use intermediate forwards, what sort of spec should we look at?

Thanks,

G.

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You don't need intermediate forwarders. Go directly to the indexers. I don't know where you're reading about this, but there is no Splunk limit anywhere near as low as 1000 or even 6000 forwarders to an indexer. (The server OS or network settings, however, may have limits configured in that may have to be found and lifted.)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You don't need intermediate forwarders. Go directly to the indexers. I don't know where you're reading about this, but there is no Splunk limit anywhere near as low as 1000 or even 6000 forwarders to an indexer. (The server OS or network settings, however, may have limits configured in that may have to be found and lifted.)

garfieldconnoll
Explorer

Thanks for the prompt response. Not sure where I found the 1000 reference, but the 6000 example came from here on Answers.
Would a single deployment server be sufficient (if we set the phone home function to 600- 1200 seconds)?

Regards,

G.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...