Looking for "high performance Splunk"

[Jason]

A client is looking for advice on tuning splunk for what they call "high performance" - defined as minimizing cpu, network transfer, disk IO.

I have been under the impression that the defaults are some of the best settings for general use, and I know the limits.conf maxKBps value will limit network traffic emitted from a forwarder.

Are there any other tunable settings you use to optimize CPU or disk use?

[Genti · Accepted solution]

If you are talking about the indexer then I think you are mixing two ideas here.
The first one is being HIGH SPLUNK PERFORMANCE, that is, Splunk works fast, Splunk indexes fast, Splunk searches fast, Splunk does everything fast. If this is what you want, then you need Lots of CPU Power, Lots of RAM, FAST Disk IO and FAST network. And more importantly, you want all of the above because you want Splunk to USE all that power.

If you want splunk not to use PC resources, then do not index too much data, do not run heavy and dense searches, do not run realtime searches, do not allow more then one user at a time, do not do regex extractions while indexing etc..etc..

The idea here is, it really depends on the load you want to put on splunk. If you want Splunk to do heavy work, then you should be willing to allow it and enable it to do so with good hardware.

[rotten]

Are you talking about minimizing the forwarder footprint, or maximizing the Indexer performance?