Installation

What is a heavy forwarders capacity?

hanilena
New Member

How much data can the heavy forwarder handle?

I don't find reference 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @hanilena,

there isn't any indication, but if you're speaking of concentrator of other Universal Forwarders, there isn't any problem because UFs locally cache data so you don't loose data.

the problem could be with syslogs, for this reason I prefer to use a Universal Forwarder using rsyslog to receive syslogs.

Anyway, you can monitor HF queues (using the Monitoring Console or dedicated searches) and identify if there's some problem, in this case you have to enlarge the max queues values.

Ciao.

giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Then only answers you can get that can be relatively thruthful is "as much as it can before clogging up". There are so many different input types and so many different things you can do at input stage that there is no single value that can be given here. Not to mention of course different specs that you can assign to the HF machine.

You'd have to be way, way more specific here.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...