Splunk Enterprise

What should the "Data Collection Interval" under Forwarder monitoring setup in MC be set to & why please? Thx

SamHTexas
Builder

What should the "Data Collection Interval" under Forwarder monitoring setup in MC be set to & why please? What is the best setting in a large environment ? We have Splunk Ent + ES. 

Should this setting match the MC on ES?

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Hard to say what is "correct" value here as it based on your needs. Just think how quickly you need to know if some FW haven't sent anything to you indexers. MC rebuilds FW lookup based on this interval and then use that lookup for other dashboards, alerts etc. Probably you should check how long it takes to rebuild that asset and then make decisions for interval based on that.

As @richgalloway already said on another thread there should be only one MC for your environment which cover all your nodes. Depending on your environment it could be on e.g. LM or it could be a separate node.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...