Indexing throughput.
Events-per-second (EPS) is a common throughput measurement, but consider that event sizes can vary from a few hundred bytes to a megabyte or more. EPS ratings are usually calculated at whatever size is optimal for one specific vendor’s appliance or solution. Look for vendors that index every byte in your data, without the need for custom parsers or connectors. If the vendor is unable or unwilling to quote you EPS figures based on this criteria, move on and find someone who will.
http://www.splunk.com/web_assets/pdfs/secure/Splunk_Guide_to_Operational_Intelligence.pdf
Got the above from Splunk OI itself and have a question over this.
Given that each of the log size is 512 bytes. Using Splunk recommended server specs itself.
What would be the EPS that we are looking at for the server ?
Can the below assumption be made based on that.
Change in limits.conf to allow this at max indexing speed to max out indexer processor.
[thruput]
maxKBps = 0
So max indexing speed would be around 9 - 10 MB/s ?
9MB = 9 * 1024 * 1024 = 9437184bytes.
9437184 bytes / 512 bytes = 18432 EPS?
any comments on the above?
... View more