Monitoring Splunk

Splunk HF Parallel Pipelines not balanced

Utkc137
Explorer

We have configured parallelIngestionPipelines as 2 in Splunk HF as we were facing congestion in the TypingQueue while our CPU was underutilized (~2 Cores used/12).

However, the load in the pipelines are not balanced. Pipeline 0 is still congested while Pipeline 1 is barely utilized.

 

Digging around, this seems to be because 80% of our input is on a single UDP port.

Will splitting the UDP ports on the source itself solve this issue? i.e. having multiple UDP Inputs on the HF instead of one?

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

much better option is use some real syslog server or SC4S to collect syslogs. And try to avoid use UDP as it always lost packets!

* If the data source is streamed over TCP or UDP, such as syslog sources, 
  only one pipeline will be used.

Based on that you cannot increase the UDP performance with adding pipelines.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...