Knowledge Management
Highlighted

Eventtypes' numbers limits

Path Finder

Good Morning all,

Anybody knows if exists a limit regarding the amount of eventtype I could set into splunk? I already started to create eventtypes and corresponding tags for a Splunk's installation over a very large IT enviroment (also multiplatform), assuming there are no restriction. In case of limitations...is there a workaround to get my goal?

Thanks in advance for your time.

Nik

Tags (3)
Highlighted

Re: Eventtypes' numbers limits

Legend

There is no hard limit, but it is probably a bad idea to have more than a few hundred as it will impact search speed. You might consider using lookup tables on data instead. These should scale to several hundred thousand or a few million entries without any trouble.

View solution in original post

Highlighted

Re: Eventtypes' numbers limits

Path Finder

Thank you gkanapathy, for your support and you precious suggestion. Have a good time!

nik

0 Karma
Highlighted

Re: Eventtypes' numbers limits

New Member

how to get only 100 recent event logs.Thanks in advance.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.