Getting Data In

Can we have fewer Heavy Forwarders than Indexers?

hrawat_splunk
Splunk Employee
Splunk Employee
 
Labels (1)
0 Karma
1 Solution

hrawat_splunk
Splunk Employee
Splunk Employee
 
 
Current practice is to have more Heavy Forwarders than Indexers to keep all indexers busy. However starting 7.3.6 onwards you don't have to. Heavy forwarder can send data to multiple indexers in parallel per ingest pipeline.

 

All you have to set in outputs.conf (maxQueueSize = 5 * autoLBVolume)

Example
autoLBVolume = 5000000
maxQueueSize =25MB

 

View solution in original post

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee
 
 
Current practice is to have more Heavy Forwarders than Indexers to keep all indexers busy. However starting 7.3.6 onwards you don't have to. Heavy forwarder can send data to multiple indexers in parallel per ingest pipeline.

 

All you have to set in outputs.conf (maxQueueSize = 5 * autoLBVolume)

Example
autoLBVolume = 5000000
maxQueueSize =25MB

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...