Tuning for performance

[halbeisendv]

While the Splunk documentation serves us well, I am interested in finding a resource for studying about performance. I have not been successful in locating commercial documentation. Thank you.

[halbeisendv]

A great deal of information in this thread; will be working threw it over the next several weeks. Thanks so much.

[gjanders · Accepted solution]

I published a conf talk related to this topic, my talk was more around the "Things I wish I knew then" wiki articles:
How’d You Get So Big? Tips & Tricks for Growing Your Splunk Deployment from 50 GB/Day to 1 TB/Day or recording here

In addition these other talks were excellent resources in addition to the above post:
The Jiffy Lube Quick Tune-­‐up For Your Splunk Environment

Also refer to the 2017 conf presentations around Splunk internals and scaling, in particular talks like Worst Practices...and How to Fix Them, the talks on Indexer scaling or 5 million buckets and beyond et cetera, there are many useful talks or documentation around this.

This is all in addition to the capacity planning manual

[masonmorales]

Here are a few good resources:
https://conf.splunk.com/files/2016/slides/architecting-splunk-for-epic-performance-at-blizzard-enter...
https://conf.splunk.com/files/2017/slides/splunk-enterprise-security-health-check.pdf
https://www.rfaircloth.com/2017/12/12/tuning-splunk-when-max-concurrent-searches-are-reached/