Compression between forwarder and indexer

[clyde772]

When applying compression on forwarder to indexer, I am suspecting it's more efficient due to splunk comsuming less Net bandwidth. Which allow more data to be transferred, that would result in higher data index rate through a forwarder.

So the question is,

1. Ultimately I would get more per second index rate when I apply compression between forwarder and indexer?

Thanks in advance to the Splunkers out there!

[rturk]

Compression is handy as it will give you more efficient transmission of data, but this doesn't have have any bearing on the indexing as the data must be uncompressed prior to being indexed.

Hope this answers your question 🙂