Monitoring Splunk
Highlighted

Performance of Splunk instance

Engager

Hi community,

we plan to encrypt our splunk installation because of some security mesaures. Encryption self works fine without any issue. I can read and write data out of Splunk into the encrypted directorys.

Following directorys are encrypted:
$splunkhome\var
$splunk
home\etc
$splunk_home\share

Now I want to check the performance of Splunk regarding a encrypted and non encrypted system. I want to see where I have now a time delay because of the encryption.

Does anyone have an idea how I can perform some good tests?

I've already done the following:
- query with "transcation" command
- query over all configured indizes
- query with additional "collect" command to perform read and write process

Thanks and best regards
seilemor

0 Karma