Installation

What is a heavy forwarders capacity?

hanilena
New Member

How much data can the heavy forwarder handle?

I don't find reference 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @hanilena,

there isn't any indication, but if you're speaking of concentrator of other Universal Forwarders, there isn't any problem because UFs locally cache data so you don't loose data.

the problem could be with syslogs, for this reason I prefer to use a Universal Forwarder using rsyslog to receive syslogs.

Anyway, you can monitor HF queues (using the Monitoring Console or dedicated searches) and identify if there's some problem, in this case you have to enlarge the max queues values.

Ciao.

giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Then only answers you can get that can be relatively thruthful is "as much as it can before clogging up". There are so many different input types and so many different things you can do at input stage that there is no single value that can be given here. Not to mention of course different specs that you can assign to the HF machine.

You'd have to be way, way more specific here.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...