Getting Data In
Highlighted

Splunk universal forwarder performance

Explorer

Hello,

Is there a performance guide for the universal forwarder (v 4.3.3)?

The indexer is running at 2 events per second and I'm only running one universal forwarder. The indexer has 16 cores and 16GB of mem and I'm having the forwarder send over a dozen, or so, files that range from a 100MB - 20GB. Both systems are underutilized for both memory and cpu (server load is around 0.5 on both).

Thanks

0 Karma
Highlighted

Re: Splunk universal forwarder performance

Splunk Employee
Splunk Employee

There is no guide, but in terms of thruput note the following:

  • A Universal Forwarder is capable of outputting at a much higher rate than a typical indexer can properly ingest.
  • A Universal Forwarder's default thruput is capped at 256KBps:

$SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/default/limits.conf
[thruput]
maxKBps = 256

Hope this helps.

d.

View solution in original post

Highlighted

Re: Splunk universal forwarder performance

Explorer

I was looking in the $SPLUNK_HOME/etc/system/default/limits.conf file and didn't look in that directory.

I've made the change to 1024 and see the increased indexer activity.

Thanks!

0 Karma