Getting Data In

Maximum number of stanzas on an indexer

gfuente
Motivator

Hello

I was wondering if there is a hard limit regarding the maximun number of stanzas that can be defined in props.conf on an indexer.

In other words, is it possible to index "unlimited" number of different sourcetypes, or there is a limit.

Regards

1 Solution

gfuente
Motivator

Well

It seems that nobody knowns the answer, so as Splunk is AWESOME I will give for granted that it is able to parse unlimited number of distinct sourcetypes.

PS: I want my self-learner badge!

View solution in original post

gfuente
Motivator

Well

It seems that nobody knowns the answer, so as Splunk is AWESOME I will give for granted that it is able to parse unlimited number of distinct sourcetypes.

PS: I want my self-learner badge!

the_wolverine
Champion

I can't answer what the hard limit is -- probably needs to be tested and confirmed by Splunk (or some unlucky customer). However there are performance issues that can result from too many source types. I've experienced them after finding a source configured with auto-sourcetyping which basically created a new sourcetype every time the log rolled. It caused Splunk performance to go down the crapper.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

It’s go time — Boston, here we come!

Are you ready to take your Splunk skills to the next level? Get set, because Splunk University is back, and ...

Performance Tuning the Platform, SPL2 Templates, and More New Articles on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...