Getting Data In

Need assistance getting large data into Splunk

Path Finder

This is a note my client sent:

I can’t really use the logs from Splunk, because they are spotty.. Think I figured out why it’s missing data though.  From our last meeting, they bumped up the transfer rate from 1024KBps to 2048KBps because the CE was generating too much data.  However, the CE raw logs generate roughly about 75MB/Minute or 1.25MBps raw.  Since Splunk does use compression at ~17%, the 2KBps gets you about 11KBps raw.  The 1.25MBps is roughly 217.6KBps compressed.  Hence, it gives you roughly 5% of the total logs.  To support Openway and prevent dropping any logs, we need to set a conservative rate to handle 110MB/minute raw, which would be ~319KBps.

We did set in the limits.conf to the 2048 mentioned above, but we're not certain how to set to a level the client needs.

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...