Splunk throughtput

[wys2010]

Here is a question from our customer. It is how many Events can splunk eat per second. I read the manual book which say only capacity plan for users and I want to know If there is a throught benchmark for them.

[wys2010]

Anthony and Genti, TKS a lot!

[Genti]

things to keep in mind:
Disk IO speed: how fast can you write to disk. If this is low, no matter how fast your machine is CPU wise or RAM wise, you will still fall short in indexing speed.
CPU: Its needed to write the info to disk, allow you to search, make it possible for you to monitor many files at the same time and parse through the logs.
RAM: well known..

[treinke]

That really depends on your hardware and network link. The better the equipment the more it will eat. Also with a distributive layout, you can put up smaller indexers across the map with a single web interface and you can get better performance due to the network delay.