Capacity of HEC token

[VijaySrrie]

Hi,

Splunk Enterprise resides in on-premises.

What would be the capacity of the HEC token?

How much logs can be ingested into splunk using 1 HEC token on daily basis?

[burwell]

Hi. So the http event collect (HEC) can send to a set of indexers. I guess you are limited by how fast the HEC can send to the indexers and how fast the indexers in turn can ingest.

I have seen recommendations from Splunk to indexer ingestion to be in the 300 to 400GB/day ingestion per indexer from all inputs but we push our indexers much harder.