Inquiry on Splunk Forwarder Performance Metrics

[suvidha]

I'm currently working on optimizing our Splunk deployment and would like to gather some insights on the performance metrics of Splunk forwarders.

1. Transfer Time for Data Transmission: I'm interested in understanding the typical time it takes for a Splunk forwarder to send a significant volume of data, say 10 GB, to the indexer. Are there any benchmarks or best practices for estimating this transfer time? Are there any factors or configurations that can significantly affect this transfer time?

2. Expected EPS (Events Per Second): Additionally, I'm curious about the achievable Event Per Second (EPS) rates with Splunk forwarders. What are the typical EPS rates that organizations achieve in real-world scenarios? Are there any strategies or optimizations that can help improve EPS rates while maintaining stability and reliability?

Any insights, experiences, or recommendations regarding these performance metrics would be greatly appreciated.

Thank you!

[richgalloway]

1. The transfer time is governed by two factors: 1) the speed of the network; and 2) the maxKBps setting in limits.conf.  The latter defaults to 256KBps (approximately), but setting it zero disables the limit and makes the network the limiting factor.

2. The EPS rate is the data transmission rate divided by the size of the events.  Both of those numbers are unknown in this thread so EPS cannot be calculated.