Monitoring Splunk

Looking for "high performance Splunk"

Jason
Motivator

A client is looking for advice on tuning splunk for what they call "high performance" - defined as minimizing cpu, network transfer, disk IO.

I have been under the impression that the defaults are some of the best settings for general use, and I know the limits.conf maxKBps value will limit network traffic emitted from a forwarder.

Are there any other tunable settings you use to optimize CPU or disk use?

Tags (3)
0 Karma
1 Solution

Genti
Splunk Employee
Splunk Employee

If you are talking about the indexer then I think you are mixing two ideas here.
The first one is being HIGH SPLUNK PERFORMANCE, that is, Splunk works fast, Splunk indexes fast, Splunk searches fast, Splunk does everything fast. If this is what you want, then you need Lots of CPU Power, Lots of RAM, FAST Disk IO and FAST network. And more importantly, you want all of the above because you want Splunk to USE all that power.

If you want splunk not to use PC resources, then do not index too much data, do not run heavy and dense searches, do not run realtime searches, do not allow more then one user at a time, do not do regex extractions while indexing etc..etc..

The idea here is, it really depends on the load you want to put on splunk. If you want Splunk to do heavy work, then you should be willing to allow it and enable it to do so with good hardware.

View solution in original post

Genti
Splunk Employee
Splunk Employee

If you are talking about the indexer then I think you are mixing two ideas here.
The first one is being HIGH SPLUNK PERFORMANCE, that is, Splunk works fast, Splunk indexes fast, Splunk searches fast, Splunk does everything fast. If this is what you want, then you need Lots of CPU Power, Lots of RAM, FAST Disk IO and FAST network. And more importantly, you want all of the above because you want Splunk to USE all that power.

If you want splunk not to use PC resources, then do not index too much data, do not run heavy and dense searches, do not run realtime searches, do not allow more then one user at a time, do not do regex extractions while indexing etc..etc..

The idea here is, it really depends on the load you want to put on splunk. If you want Splunk to do heavy work, then you should be willing to allow it and enable it to do so with good hardware.

rotten
Communicator

Are you talking about minimizing the forwarder footprint, or maximizing the Indexer performance?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...