Getting Data In

Aggregating WinEventLogs from 2,000 XP machines, total daily volume 20GB

garfieldconnoll
Explorer

Hi,

So we've 2,000 XP machines generating c.20GB of WinEventLogs. For compliance reasons, we want to log it centrally.

We're considering using universal forwarders on each machine and then using 2- 4 intermediate forwarders to aggregate onto a single indexer.

I've read else where about suggested max ratio of 1000: 1 forwarders to indexer and even of an example of 6000:1 in a similar use case.

If we do use intermediate forwards, what sort of spec should we look at?

Thanks,

G.

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You don't need intermediate forwarders. Go directly to the indexers. I don't know where you're reading about this, but there is no Splunk limit anywhere near as low as 1000 or even 6000 forwarders to an indexer. (The server OS or network settings, however, may have limits configured in that may have to be found and lifted.)

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You don't need intermediate forwarders. Go directly to the indexers. I don't know where you're reading about this, but there is no Splunk limit anywhere near as low as 1000 or even 6000 forwarders to an indexer. (The server OS or network settings, however, may have limits configured in that may have to be found and lifted.)

garfieldconnoll
Explorer

Thanks for the prompt response. Not sure where I found the 1000 reference, but the 6000 example came from here on Answers.
Would a single deployment server be sufficient (if we set the phone home function to 600- 1200 seconds)?

Regards,

G.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...