Getting Data In

Performance Tuning or Other Hints for Windows Event Forwarding

hughkelley
Path Finder

We have been using WEF as our collection point for a while.  We started out small but have expanded the range of events over time.   We have ~5,000 hosts forwarding to a single collector.

The collector is busy, but seems to be healthy based on conventional Windows indicators.

However,  we have some data loss between the centralized event and Splunk (cloud).   Logs show up in the WEF collection log but never make it to the index.

 

First,   are there any performance tuning suggestions you can offer UF on a WEF collector?

Second,  can you think of any way to check on processing of a single event once it goes into the UF and heads to the indexer?

Labels (2)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!