All Apps and Add-ons

Initial stage of Splunk performance tunning

rreddy012c
New Member

We have deployed our splunk in our organization. We are currently ingesting 1.7 TB data per day and it can increase up to 3.5 TB. We are using high performance hardware resources for splunk.
Now I would like to know what would be the better tuning memory parameters which need to set for SH/Indexer to increase the performance? Otherthan memory do we need to look into any other settings?

Tags (1)
0 Karma

ddrillic
Ultra Champion

Many many aspects are involved. The following can assist - Optimize Splunk for peak performance

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Depending on the specs of your indexers, you could enable parallelization to increase throughput

http://docs.splunk.com/Documentation/Splunk/6.6.3/Capacity/Parallelization

0 Karma

rreddy012c
New Member

Thanks for suggestion and How memory does splunk allocates for each search?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Splunk cares more about CPU cores than memory. A rule of thumb is each concurrent search represents approx 1 CPU core. This is configurable though

http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/Referencehardware

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...