Dashboards & Visualizations

noobie questions: How frequently does splunk index incoming update from forwarder?

reviewphile
New Member

noobie questions: How frequently does splunk index incoming updates (event logs) from forwarder. n other workds what are the Default settings for index refresh.

Also on the forwarder, i read from these Q&A pages that there is no way to batch the events (e.g. in windows event logs) on the forwarding server (Where forwarder is installed) such that i can send the events when a certain threshold (file size/event counter) is reached - any update will be captured by the forwarder and sent to the splunk server (correct?) So network essentially on the forwarding side caps my throughput.

0 Karma

yannK
Splunk Employee
Splunk Employee

How frequently does splunk index incoming updates (event logs) from forwarder.

The indexer will proceed with any data received Immediately.

  • If the indexer happen to be too busy (queues blocked or full), it will tell the forwarders to stop sending data (and pause monitoring).
  • On the forwarder side, the limit is usually the default thruput ( see limits.conf) or the number of inputs/file to collect that can delay the monitoring.
0 Karma

aholzer
Motivator

If you are talking about the monitor stanza (where you monitor a particular file or directory) the default is 3 seconds. This is set on the forwarder side, not the indexer. The attribute is called "time_before_close" and can be found in inputs.conf. This attribute tells your forwarder to keep a file open for 3 seconds after it sees an update before sending it to the indexer.

If you are asking about any other stanza, there are attributes like "interval", that you can define to tell your forwarder exactly how often you want to send data.

Take a look in the inputs.conf.spec.

Hope this helps.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...