Splunk Search

buffering and flush time

pkernevez
New Member

Hi,

Will have a very variable throughput. Some time with a lot of Http request (about 100.000 per seconds during one minute) and some minutes without any request. I suppose that splunk do some buffering for dealing with high volume.

Is there a configuration parameter to configure the 'max flush time'. This time is the max amount of time that splunk will wait some new event for filling its buffer ? In other term splunk will decide to send events event the buffer is half filled.

We want to be sure that if we wait X seconds after the last message receive by our system, we don't miss some event awaiting others in any buffer.

Thanks

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Splunk sends and indexes data as fast as it receives it. Buffering is only used to queue data if it is being received faster than it can be processed. Flushing is therefore continuous.

jfraiberg
Communicator

as far as I know there is no buffering going on if you are indexing a local file, it is real time. If you use a forwarder, you can have buffer settings for when the indexer goes down.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...