Hello team,
I have a configured a Splunk application and trying to run the Eventgen to test the performance of the Splunk app. The expection is to Generate around 500MB of events in a second.
However when i tried to run the Evengen, its just generating around 2MB of Events. Can you please help me in generating a much load to test the performance of the Splunk application. Thanks
Regards,
Hari
I stopped using EventGen long ago , GoGen scales much better : https://github.com/coccyx/gogen
HI @hariboppana,
Can you please check below link?
https://www.function1.com/2016/04/how-to-generate-1-tb-of-data-for-splunk-performance-testing
Thanks
Hello Kamlesh,
Thanks for the link and i have followed the same. however i cannot able to generate 0.5G per minute.My conf file is just generating 60MB per minute.
Would appreciate any help.. Thanks
Regards,
Hari
+919741979801
HI @hariboppana,
My another approach is to generate events using scripted input. (Not using EventGen)
If we create few files with huge MB size of events and will use in scripted input which read these file and just index it. This will increase the size per minute. Is it ok to you? In this case, indexer must have high resources like CPU RAM even DISK Space.
BTW
Do you have any specific format for an event?
Thanks
From that page: "Generating 125 GB of data takes about 4 hours." Which is about 0.52 G per minute, or 9 Meg per second. That ad hoc speed is not going to meet the test requirements.
However, the actual test requirements may or may not be able to be met using the tool, depending on what @hariboppana means by "test the performance of the Splunk app". If he is testing the ingestion speed, then the data for the test can be generated in advance rather than on the fly. In that case, the above 4 hours would generate 125G of data, which when broken into chunks and delivered simultaneously would enable such stress testing for a little over 4 minutes.
Thanks DalJeanis.
I am generating the data on the fly. Eventgen is generating just 1MB per second and the output is the file mode. I dont know whether i am making a mistake in the eventgen conf file or is it depends on the Sample file as well?
Please help me in eventgen.conf configuration file and sample data [If have any] so that i can reach a 0.5G per minute.
Thanks in advance
Hari
+919741979801
@DalJeanis
Agreed.
So in this case, as a part of performance testing, is it ok if we increase the events of sample files and also increase the number of files & minimize the interval ?? I think in this case the resource should also with high configuration. Can you please provide your inputs?
Thanks