Monitoring Splunk

Inquiry on Splunk Forwarder Performance Metrics

suvidha
New Member

I'm currently working on optimizing our Splunk deployment and would like to gather some insights on the performance metrics of Splunk forwarders.

  1. Transfer Time for Data Transmission: I'm interested in understanding the typical time it takes for a Splunk forwarder to send a significant volume of data, say 10 GB, to the indexer. Are there any benchmarks or best practices for estimating this transfer time? Are there any factors or configurations that can significantly affect this transfer time?

  2. Expected EPS (Events Per Second): Additionally, I'm curious about the achievable Event Per Second (EPS) rates with Splunk forwarders. What are the typical EPS rates that organizations achieve in real-world scenarios? Are there any strategies or optimizations that can help improve EPS rates while maintaining stability and reliability?

Any insights, experiences, or recommendations regarding these performance metrics would be greatly appreciated.

Thank you!

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

1. The transfer time is governed by two factors: 1) the speed of the network; and 2) the maxKBps setting in limits.conf.  The latter defaults to 256KBps (approximately), but setting it zero disables the limit and makes the network the limiting factor.

2. The EPS rate is the data transmission rate divided by the size of the events.  Both of those numbers are unknown in this thread so EPS cannot be calculated.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...