Capacity of HEC token

VijaySrrie · ‎12-04-2020

Hi,

Splunk Enterprise resides in on-premises.

What would be the capacity of the HEC token?

How much logs can be ingested into splunk using 1 HEC token on daily basis?

burwell · ‎12-05-2020

Hi. So the http event collect (HEC) can send to a set of indexers. I guess you are limited by how fast the HEC can send to the indexers and how fast the indexers in turn can ingest.

I have seen recommendations from Splunk to indexer ingestion to be in the 300 to 400GB/day ingestion per indexer from all inputs but we push our indexers much harder.

Capacity of HEC token

HTTP Event Collector

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

Splunk Technical Support Is Moving to Cisco Support Tools

Join the Conversation

Capacity of HEC token

HTTP Event Collector

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

Splunk Technical Support Is Moving to Cisco Support Tools