Monitoring Splunk

What is the expected response time for an HEC POST?

Influencer

We're seeing about 50 ms. Normal range? How would we optimize this?

EDIT: Also, how do you measure HEC performance from Splunk's point of view? I don't see anything in metrics that explicitly calls out HEC. Since the end user can adjust source arbitrarily, how do you isolate HEC stats from metrics?

1 Solution

Contributor

You can use Distributed Management Console (Version 6.5 # now calls it Monitoring Console) has 2 dashboard that provides an overview of your HEC performance across the deployment. You can enable and check performance.
Reference # https://docs.splunk.com/Documentation/Splunk/6.5.2/DMC/Inputdashboards

View solution in original post

Contributor

You can use Distributed Management Console (Version 6.5 # now calls it Monitoring Console) has 2 dashboard that provides an overview of your HEC performance across the deployment. You can enable and check performance.
Reference # https://docs.splunk.com/Documentation/Splunk/6.5.2/DMC/Inputdashboards

View solution in original post

Influencer

Old reply: Yeah, I see the HEC dashboards. But they simply say "You currently have no tokens configured" which is not correct. I don't see anything in the MC setup that references HEC.

Assuming I can get it working, this looks like a good place to start. Thanks.

SplunkTrust
SplunkTrust

You could roll your own...

modular inputs aren't terribly difficult.

50ms isn't that bad though...

I think id be happy with that.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!