What's the average throughput that Splunk can handle to create an up to date real-time report with a maximum delay of 15 seconds??

New Member

I'm new at Splunk and I'm trying to develop a real-time reporting tool that keeps track of around 50k records per second, but I've noticed that Splunk has some difficulty to make reports in real-time with this amount of records. Does anyone know the average throughput that Splunk can handle to make a good and up to date real-time report with a maximum delay of 15 seconds

0 Karma


There are a lot of variables here that I don't think can be properly answered without testing on your own system, but maybe this will help.

I had a slow, old server that could real-time syslog messages from our firewall at perhaps 5000 per second with just a couple of seconds of lag. Most of that lag was NOT Splunk's fault, though, it was traced one day to the ASA not prioritizing syslog stuff well enough so wouldn't get them to Splunk in a timely manner. Splunk itself had nearly zero lag and what was there seemed to just be lag on the browser/client rendering side.

I don't know the typical amount of lag in reading files, so there's another place for things to go slightly slow - how are the 50k records per second getting into Splunk? Is it coming in via syslog and the syslog application is buffering?

Also, the SIZE of the records needs to be taken into consideration, too.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...