Performance of Splunk instance

[seilemor]

Hi community,

we plan to encrypt our splunk installation because of some security mesaures. Encryption self works fine without any issue. I can read and write data out of Splunk into the encrypted directorys.

Following directorys are encrypted:
$splunk_home\var
$splunk_home\etc
$splunk_home\share

Now I want to check the performance of Splunk regarding a encrypted and non encrypted system. I want to see where I have now a time delay because of the encryption.

Does anyone have an idea how I can perform some good tests?

I've already done the following:
- query with "transcation" command
- query over all configured indizes
- query with additional "collect" command to perform read and write process

Thanks and best regards
seilemor

[woodcock · Accepted solution]

https://www.splunk.com/blog/2014/05/07/splunk-sizing-and-performance-doing-more-with-more.html
https://splunkbase.splunk.com/app/749/