Hi All,
I've report server, which producing log data in "report.log" file, the max size of report.log is 10MB and it will create versions.
some time my report server writing data at 10 MB/s if my splunk forwarder is not forwarding at this rate i will loose data bcz it will create new versions.
my question : Splunk can forward at 10 MB/s if YES what hardware required.
Pls advise me
Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.
https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.ht...
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html
Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.
https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.ht...
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html
Thanks Thanks
This sounds like it answered your question , x05311. I have converted it to an Answer, so if it was the answer you were looking for could you please mark this as accepted?
Thanks!
-Rich