Getting Data In

Can Splunk forwarder will forward data at high speed

x05311
Explorer

Hi All,

I've report server, which producing log data in "report.log" file, the max size of report.log is 10MB and it will create versions.
some time my report server writing data at 10 MB/s if my splunk forwarder is not forwarding at this rate i will loose data bcz it will create new versions.

my question : Splunk can forward at 10 MB/s if YES what hardware required.

Pls advise me

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.

https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.ht...
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Splunk can take care of monitoring of data even with file gets rolled over (assuming that's what you mean when you said versions). The forwarder's data forwarding rate is managed by a limits.conf property maxKBPS. Actual rate will depend upon the available resources (CPU/Memory) on the forwarder and network bandwidth/speed. Have decently sized forwarder (http://docs.splunk.com/Documentation/Splunk/6.5.3/Capacity/Referencehardware) and good network speed and you should be able to ingest @ 10MBPS.

https://answers.splunk.com/answers/29538/maxkbps-option-and-limiting-a-forwarders-rate-of-thruput.ht...
https://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder.html

0 Karma

x05311
Explorer

Thanks Thanks

0 Karma

Richfez
SplunkTrust
SplunkTrust

This sounds like it answered your question , x05311. I have converted it to an Answer, so if it was the answer you were looking for could you please mark this as accepted?

Thanks!

-Rich

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...