Monitoring Splunk

How many tags is too many tags?

Justin_Grant
Contributor

How many tags can be created before Splunk's performance is adversely affected? And what specifcally is adversely affected when too many tags are defined-- index perf, search perf, or both?

Tags (2)
1 Solution

Justin_Grant
Contributor

Per Steve Z, one of Splunk's rocket scientists:

The tag approach is definitely not scalable beyond a few thousand. Tags were designed to handle expanding to tens or hundreds of values, not tens of thousands or more. Also, note that tagging is designed to tag specific values of a single field, rather than events as a whole

View solution in original post

fwilmot
Splunk Employee
Splunk Employee

I wouldn't recommend more than 1000 tags, I have seen degradation linked to applications loading a specific amount of tags and neglecting tags that correlate to the same numbers of hosts beyond the 1000 mark. Though they don't have any impact on indexing, search can be more meaningful with better direction of your catagories through eventtypes. This can also be associated with hosts r sources, as opposed to matching a case in an event.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Tags have no effect on indexing or indexing performance, so any effect would only be realized at search time.

Justin_Grant
Contributor

Per Steve Z, one of Splunk's rocket scientists:

The tag approach is definitely not scalable beyond a few thousand. Tags were designed to handle expanding to tens or hundreds of values, not tens of thousands or more. Also, note that tagging is designed to tag specific values of a single field, rather than events as a whole

Stephen_Sorkin
Splunk Employee
Splunk Employee

To extend this, the better bet is to use field lookups, which scale easily to millions of items. Another technique is eventtypes, which allow for "tagging" of events that match generic search expressions.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...