HEC Collector Cluster: Measuring Performance

[amat]

I've been looking around how to measure and scale a Splunk HEC Collector cluster, but I cant seem to find direct answers.

I am trying to find a way to measure the performance of a HEC Collector and how to determine when a HEC Collector cluster needs to be scaled to accommodate more/less HEC requests. I understand that EPS ( events per second) can be measured but how does one determine if that number is too high or too low?

Currently, i have two Heavyforwarders that are acting as HEC Collectors behind a load balancer. I am trying to find out a good way to determine if this is enough or if another member needs to be added.

Appreciate the help!

[PavelP]

Hello @amat

not quite what you asked: you can measure the indexing performance which includes HEC Collector latency. You can do this:

• directly with metrics data or as diff between _indextime and _time
• using Monitoring Console (MC)

Before you add more HEC Collectors, try to tune your setup:

• https://conf.splunk.com/files/2017/slides/measuring-hec-performance-for-fun-and-profit.pdf
• https://www.splunk.com/en_us/blog/tips-and-tricks/turbo-charging-modular-inputs-with-the-hec-http-ev...