Getting Data In

Maximum number of stanzas on an indexer

gfuente
Motivator

Hello

I was wondering if there is a hard limit regarding the maximun number of stanzas that can be defined in props.conf on an indexer.

In other words, is it possible to index "unlimited" number of different sourcetypes, or there is a limit.

Regards

1 Solution

gfuente
Motivator

Well

It seems that nobody knowns the answer, so as Splunk is AWESOME I will give for granted that it is able to parse unlimited number of distinct sourcetypes.

PS: I want my self-learner badge!

View solution in original post

gfuente
Motivator

Well

It seems that nobody knowns the answer, so as Splunk is AWESOME I will give for granted that it is able to parse unlimited number of distinct sourcetypes.

PS: I want my self-learner badge!

View solution in original post

the_wolverine
Champion

I can't answer what the hard limit is -- probably needs to be tested and confirmed by Splunk (or some unlucky customer). However there are performance issues that can result from too many source types. I've experienced them after finding a source configured with auto-sourcetyping which basically created a new sourcetype every time the log rolled. It caused Splunk performance to go down the crapper.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!