How does Splunk SE impact existing infrastructure performance?

[ITAdminBart]

Hello,

I have been searching for hours but I have yet to come across to an answer to my question:

- How does Splunk SE impact the performance of my existing infrastructure since it will ingest and process a lot of data? (I'm talking CPU performance of switches, virtual machines etc. and general bandwith)

If there's a general answer to this question then please let me know. If there's a specific answer to this question and lots more information is needed: Which steps can my organization undertake to get a better view of the performance situation?

Thanks!

[richgalloway · Accepted solution]

Are you referring to the Security Essentials (SE) app or the Enterprise Security (ES) app?  The question mentions the former, but it's in the ES forum.

Neither app ingests any data as they both simply use the data that's already ingested.

There is no specific answer to the question because the performance will depend on how you use the app.  The more searches you run the more performance will be impacted.

ES is a known resource hog.  That's why Splunk recommends it be installed on a dedicated search head.

As for how to get a better view of the performance situation, use the same techniques you use to monitor the performance of any of your servers.  For a more specific answer, ask a more specific question.