Splunk Search

buffering and flush time

pkernevez
New Member

Hi,

Will have a very variable throughput. Some time with a lot of Http request (about 100.000 per seconds during one minute) and some minutes without any request. I suppose that splunk do some buffering for dealing with high volume.

Is there a configuration parameter to configure the 'max flush time'. This time is the max amount of time that splunk will wait some new event for filling its buffer ? In other term splunk will decide to send events event the buffer is half filled.

We want to be sure that if we wait X seconds after the last message receive by our system, we don't miss some event awaiting others in any buffer.

Thanks

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Splunk sends and indexes data as fast as it receives it. Buffering is only used to queue data if it is being received faster than it can be processed. Flushing is therefore continuous.

jfraiberg
Communicator

as far as I know there is no buffering going on if you are indexing a local file, it is real time. If you use a forwarder, you can have buffer settings for when the indexer goes down.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...