Getting Data In

When sending data with http event collector is there any throttling by default?

andyy5
New Member

Hello,

When sending data with HEC to Splunk Enterprise/Cloud, is there any throttling by default? Or is there an option to set this?
I plan on sending data every few seconds for a long period of time.

Thanks.

0 Karma

ivanreis
Builder

I did not play around the HEC for Splunk cloud. Per my research the HEC is enabled by default for your Splunk Cloud environment with a 1 MB size limit on the maximum content length.

For further information about the cloud limits and constraints, check the link below:
https://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice#Service_limits_a...

If you need to increase the capacity
https://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice#Subscription_exp...

For Splunk Enterprise there are two parameter that you have to play around. They are "queueSize" and "persistentQueueSize" that you have to setup at inputs.conf under http stanza like this one: [http://yourtokenname]

queueSize The maximum size of the input queue in memory. The value of this parameter is in the form [KB|MB|GB]. The default value is 500KB.

persistentQueueSize = [KB|MB|GB|TB]
* Maximum size of the persistent queue file.
* Persistent queues can help prevent loss of transient data. For information on
persistent queues and how the 'queueSize' and 'persistentQueueSize' settings
interact, search the online documentation for "persistent queues"..
* If you set this to a value other than 0, then 'persistentQueueSize' must
be larger than either the in-memory queue size (as defined by the
'queueSize' setting in inputs.conf or 'maxSize' settings in [queue] stanzas
in server.conf).
* Default: 0 (no persistent queue).

https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/UseHECusingconffiles#Per-token_settings

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...