All Apps and Add-ons

Initial stage of Splunk performance tunning

rreddy012c
New Member

We have deployed our splunk in our organization. We are currently ingesting 1.7 TB data per day and it can increase up to 3.5 TB. We are using high performance hardware resources for splunk.
Now I would like to know what would be the better tuning memory parameters which need to set for SH/Indexer to increase the performance? Otherthan memory do we need to look into any other settings?

Tags (1)
0 Karma

ddrillic
Ultra Champion

Many many aspects are involved. The following can assist - Optimize Splunk for peak performance

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Depending on the specs of your indexers, you could enable parallelization to increase throughput

http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/Parallelization

0 Karma

rreddy012c
New Member

Thanks for suggestion and How memory does splunk allocates for each search?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Splunk cares more about CPU cores than memory. A rule of thumb is each concurrent search represents approx 1 CPU core. This is configurable though

http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/Referencehardware

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...