- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
While the Splunk documentation serves us well, I am interested in finding a resource for studying about performance. I have not been successful in locating commercial documentation. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I published a conf talk related to this topic, my talk was more around the "Things I wish I knew then" wiki articles:
How’d You Get So Big? Tips & Tricks for Growing Your Splunk Deployment from 50 GB/Day to 1 TB/Day or recording here
In addition these other talks were excellent resources in addition to the above post:
The Jiffy Lube Quick Tune-‐up For Your Splunk Environment
Also refer to the 2017 conf presentations around Splunk internals and scaling, in particular talks like Worst Practices...and How to Fix Them, the talks on Indexer scaling or 5 million buckets and beyond et cetera, there are many useful talks or documentation around this.
This is all in addition to the capacity planning manual
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A great deal of information in this thread; will be working threw it over the next several weeks. Thanks so much.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I published a conf talk related to this topic, my talk was more around the "Things I wish I knew then" wiki articles:
How’d You Get So Big? Tips & Tricks for Growing Your Splunk Deployment from 50 GB/Day to 1 TB/Day or recording here
In addition these other talks were excellent resources in addition to the above post:
The Jiffy Lube Quick Tune-‐up For Your Splunk Environment
Also refer to the 2017 conf presentations around Splunk internals and scaling, in particular talks like Worst Practices...and How to Fix Them, the talks on Indexer scaling or 5 million buckets and beyond et cetera, there are many useful talks or documentation around this.
This is all in addition to the capacity planning manual
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here are a few good resources:
https://conf.splunk.com/files/2016/slides/architecting-splunk-for-epic-performance-at-blizzard-enter...
https://conf.splunk.com/files/2017/slides/splunk-enterprise-security-health-check.pdf
https://www.rfaircloth.com/2017/12/12/tuning-splunk-when-max-concurrent-searches-are-reached/
