Monitoring Splunk

Why is the Windows Event Log indexing slow?

spiced
New Member

I indexed about 1GB of Windows Event Logs for a forensic analysis. I added the data by monitoring the folder where the Event Log files are located. The indexing took about 18 hours to complete. The load of server that I used for processing is low. I do not understand why processing 1GB of event logs takes so much time, I would expect it to take about 30 Minutes. Is there a way I can speed this process up? How can I find out what the bottlenech of the processing is? How do I find out when the processing is finished. I refreshed the search from time to time until I no additional events showed up?

Labels (1)
0 Karma

woodcock
Esteemed Legend

You probably have the default maxKBps which I think is 1024. Set this to 0 in limits.conf on your forwarders.

0 Karma

spiced
New Member

I only have an indexer, there is no forwarder. On the indexer maxKBps is already set to 0 so it must be something else.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.