How can I measure performance of Splunk about indexing events.
I want to increase MAX_TIMESTAMP_LOOKAHEAD for the event. I can directly see that doing this would decrease performance, but I want to compare the performance to something like this: if I put a higher MAX_TIMESTAMP_LOOKAHEAD , then how much performance will be degraded compared to when I keep it low?
In short, is there any way to benchmark performance of the event indexing?
After posting question I got the answer myself, which included no effort and gives very good idea about performance.
In Splunk go to Settings > Monitoring Console > Indexing > Indexing Performance: Instance
Try Monitoring Console for lot more then just indexing performance - http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview
After posting question I got the answer myself, which included no effort and gives very good idea about performance.
In Splunk go to Settings > Monitoring Console > Indexing > Indexing Performance: Instance
Try Monitoring Console for lot more then just indexing performance - http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview
hi @VatasalJagani
I'm glad you figured out the answer to your question. Would you mind approving your answer so that others can learn from your experience?
Thanks!
I've accepted the answer but other answer is also nice to hear.