Getting Data In

Can Splunk forwarder will forward data at high speed

x05311
Explorer

Hi All,

I've report server, which producing log data in "report.log" file, the max size of report.log is 10MB and it will create versions.
some time my report server writing data at 10 MB/s if my splunk forwarder is not forwarding at this rate i will loose data bcz it will create new versions.

my question : Splunk can forward at 10 MB/s if YES what hardware required.

Pls advise me

0 Karma
1 Solution

somesoni2
Revered Legend

Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.

https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.ht...
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html

View solution in original post

0 Karma

somesoni2
Revered Legend

Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.

https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.ht...
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html

0 Karma

x05311
Explorer

Thanks Thanks

0 Karma

Richfez
SplunkTrust
SplunkTrust

This sounds like it answered your question , x05311. I have converted it to an Answer, so if it was the answer you were looking for could you please mark this as accepted?

Thanks!

-Rich

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...