Splunk Search

buffering and flush time

pkernevez
New Member

Hi,

Will have a very variable throughput. Some time with a lot of Http request (about 100.000 per seconds during one minute) and some minutes without any request. I suppose that splunk do some buffering for dealing with high volume.

Is there a configuration parameter to configure the 'max flush time'. This time is the max amount of time that splunk will wait some new event for filling its buffer ? In other term splunk will decide to send events event the buffer is half filled.

We want to be sure that if we wait X seconds after the last message receive by our system, we don't miss some event awaiting others in any buffer.

Thanks

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Splunk sends and indexes data as fast as it receives it. Buffering is only used to queue data if it is being received faster than it can be processed. Flushing is therefore continuous.

jfraiberg
Communicator

as far as I know there is no buffering going on if you are indexing a local file, it is real time. If you use a forwarder, you can have buffer settings for when the indexer goes down.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...