Getting Data In

Compression between forwarder and indexer

clyde772
Communicator

When applying compression on forwarder to indexer, I am suspecting it's more efficient due to splunk comsuming less Net bandwidth. Which allow more data to be transferred, that would result in higher data index rate through a forwarder.

So the question is,

  1. Ultimately I would get more per second index rate when I apply compression between forwarder and indexer?

Thanks in advance to the Splunkers out there!

Tags (2)
0 Karma

rturk
Builder

Compression is handy as it will give you more efficient transmission of data, but this doesn't have have any bearing on the indexing as the data must be uncompressed prior to being indexed.

Hope this answers your question 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...