Hi All, I'm trying to see if we can improve the performance of a Splunk instance and trying to optimize it - e.g. putting sourcetype instead of letting it being automatic/etc. There is a data input that's monitoring a directory, and there are about 20,000 files within said directory. I've added ignoreolderthan = 7d to the inputs.conf The question is: - Does adding ignoreolderthan in inputs.conf make Splunk ignore those files? Does that mean that I should be seeing less files being monitored in /splunk list monitor as well as the Data Inputs in the Splunk webpage? - Or is the only way to minimize the number of files being monitored is to move those files OUT of the monitored directory? Thank you. ... View more

Hi all, Are there recommended guidelines or best practices on what would be the optimal amount of apps or data inputs (monitor) that a single instance should have? I gather that the apps don't really matter, but I've noticed that if a single instance has plenty of data inputs via file monitoring / receiving data from a forwarder, the indexing slows down simply because it needs to parse through all the monitoring tail processor is doing first; are my thoughts correct? Thank you. ... View more

Hi Everyone, I'm testing a simple setup of a search head on a single 24 core host. The setup basically consists of 1 x forwarder, 1 x search head, 3 x search peers. Following the setup from Splunk seems to work OK. Forwarder is forwarding with a load balance across the peers and I can search via search head. The issue is that it seems the search performance is far slower versus a single instance test we had. For example, on a single simple search (index = xxx) that yielded say 11 million records, it might take 10 minutes on the search head but will take far less time on the single instance. I was under the impression that search head should yield shorter search times, is it not? Any pointers would be appreciated! Thank you. Edit: - I've tried adding threaded & SSL changes from http://answers.splunk.com/answers/105721/distributed-search-performance.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev without much changes in search results - Do I need to do mounted bundles? I don't think that's needed seeing as we're doing all within the same hosts (different instances) ... View more

Hi all, I'm testing a Universal Forwarder deployment - a real simple one. Basically I have a directory in a serverX that I'd like to forward to a Unix Splunk instance that's sitting on another serverY. So I set up the Splunk UF in serverX and everything is well with the setup. However, I wanted to know if it's forwarding all the data from the directory correctly - so what I did was did multiple copies of the same directory and have it forwarded to different index (e.g. dirA -> IndexA, dirB -> IndexB, dirC -> indexC). What's interesting is the first index generally goes through, but the other indexes do not seem to be receiving data. For example: IndexA -> 200 events IndexB -> 150 events IndexC -> 0 events I've confirmed that the data in indexB IS in indexA, but it's not indexing all of them. There are also no apparent errors in the logs of UF. Any ideas or leads would be appreciated. Thank you. ... View more