Monitoring Splunk

Splunk HF Parallel Pipelines not balanced

Utkc137
Explorer

We have configured parallelIngestionPipelines as 2 in Splunk HF as we were facing congestion in the TypingQueue while our CPU was underutilized (~2 Cores used/12).

However, the load in the pipelines are not balanced. Pipeline 0 is still congested while Pipeline 1 is barely utilized.

 

Digging around, this seems to be because 80% of our input is on a single UDP port.

Will splitting the UDP ports on the source itself solve this issue? i.e. having multiple UDP Inputs on the HF instead of one?

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

much better option is use some real syslog server or SC4S to collect syslogs. And try to avoid use UDP as it always lost packets!

* If the data source is streamed over TCP or UDP, such as syslog sources, 
  only one pipeline will be used.

Based on that you cannot increase the UDP performance with adding pipelines.

r. Ismo 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...