Hi,
I am facing some performance challenges and hence wanted to get clarification on a few things. I have data sitting on two drives. I am indexing this data on Splunk. I have currently added these two mount drives as network drive on my computer and added the inputs locally on the indexer.
However, another solution could be to forward the data from these two locations, using an universal forwarder, to the indexer machine.
Since, our system performance is really slow with a distributed setup of an indexer and a searchhead. I want to know if using forwarders has a performance advantage over adding data by adding the network drives.
Thanks!
... View more