Splunk Dev

Best Practice for index configuration consisting of millions of small events (syslog)

Esky73
Builder

We are ingesting syslog which has approximately 2.5 million events every 15 mins.

Are there any best practices or recommendations to optimise the index\buckets in this scenario

thx

Tags (1)
0 Karma

koshyk
Super Champion

I hope your question is related to Splunk indexing and NOT configuration for syslog?
some of the practices we follow

  • Ensure syslog logs in a consistent directory structure. So the template should be fine tuned to create a good hierarchy structure. eg /data/syslog/$port/$ip-host/$facility.$priority.log
  • Ensure logrotate is enabled to rotate these logs after a time or size. Ensure delaycompress option is enabled
  • Based on naming convention or IP ranges, your Splunk inputs should collect and assign correct sourcetype at collection itself (eg: /data/syslog/514/my-cisco-device/kern.info.log should be assigned the relevant sourcetype, source, index, host at collection time)
  • The index and indextime fields should be already present in your indexes/props for correct data indexing. (eg create mycompany_network index for network-data and props should align to the CIM model fields if possible)
  • if you use multiple syslog servers, ensure no duplication happens on the data
  • our experience shows with Splunk recommended indexers x 4, we can collect and index about your number without any impact to searches.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...