Getting Data In

Capacity of HEC token



Splunk Enterprise resides in on-premises.

What would be the capacity of the HEC token?

How much logs can be ingested into splunk using 1 HEC token on daily basis?



Labels (1)
Tags (1)
0 Karma


Hi. So the http event collect (HEC) can send to a set of indexers. I guess you are limited by how fast the HEC can send to the indexers and how fast the indexers in turn can ingest.

I have seen recommendations from Splunk to indexer ingestion to be in the 300 to 400GB/day ingestion per indexer from all inputs but we push our indexers much harder.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!