Can Splunk forwarder will forward data at high speed

[x05311]

Hi All,

I've report server, which producing log data in "report.log" file, the max size of report.log is 10MB and it will create versions.
some time my report server writing data at 10 MB/s if my splunk forwarder is not forwarding at this rate i will loose data bcz it will create new versions.

my question : Splunk can forward at 10 MB/s if YES what hardware required.

Pls advise me

[somesoni2 · Accepted solution]

Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.

https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.ht...
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html

[x05311]

Thanks Thanks

[Richfez]

This sounds like it answered your question , x05311. I have converted it to an Answer, so if it was the answer you were looking for could you please mark this as accepted?

Thanks!

-Rich