Monitoring Splunk

Splunk HF Parallel Pipelines not balanced

Utkc137
Explorer

We have configured parallelIngestionPipelines as 2 in Splunk HF as we were facing congestion in the TypingQueue while our CPU was underutilized (~2 Cores used/12).

However, the load in the pipelines are not balanced. Pipeline 0 is still congested while Pipeline 1 is barely utilized.

 

Digging around, this seems to be because 80% of our input is on a single UDP port.

Will splitting the UDP ports on the source itself solve this issue? i.e. having multiple UDP Inputs on the HF instead of one?

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

much better option is use some real syslog server or SC4S to collect syslogs. And try to avoid use UDP as it always lost packets!

* If the data source is streamed over TCP or UDP, such as syslog sources, 
  only one pipeline will be used.

Based on that you cannot increase the UDP performance with adding pipelines.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...