What's the average throughput that Splunk can handle to create an up to date real-time report with a maximum delay of 15 seconds??

New Member

I'm new at Splunk and I'm trying to develop a real-time reporting tool that keeps track of around 50k records per second, but I've noticed that Splunk has some difficulty to make reports in real-time with this amount of records. Does anyone know the average throughput that Splunk can handle to make a good and up to date real-time report with a maximum delay of 15 seconds

0 Karma


There are a lot of variables here that I don't think can be properly answered without testing on your own system, but maybe this will help.

I had a slow, old server that could real-time syslog messages from our firewall at perhaps 5000 per second with just a couple of seconds of lag. Most of that lag was NOT Splunk's fault, though, it was traced one day to the ASA not prioritizing syslog stuff well enough so wouldn't get them to Splunk in a timely manner. Splunk itself had nearly zero lag and what was there seemed to just be lag on the browser/client rendering side.

I don't know the typical amount of lag in reading files, so there's another place for things to go slightly slow - how are the 50k records per second getting into Splunk? Is it coming in via syslog and the syslog application is buffering?

Also, the SIZE of the records needs to be taken into consideration, too.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...