Getting Data In

Why is my WinEventLog collection process slow?

mshilston
Path Finder

Hi All,

I've been thinking for some time that I am not getting the performance I should be out of my Splunk setup and I'd like some advice for troubleshooting.

Currently, I have a single Search Head, which is searching across two Indexers (non-clustered) and a few Universal Forwarders.

They are all VMs, but with 4vCPUs and 10GB RAM and are idle most of the time. Forgetting the complete setup for now, I am focusing on a test which involved me stopping the services on Indexer 1 and clearing the indexes on it, including the fishbuket index.

I have three inputs for Event Logs;
- Application log going to an 'application' index
- Security log going to a 'security' index
- System log going to a 'system' index

All indexes are defined in the indexes.conf

I have configued the inputs.conf to collect local event logs on Indexer 1, so when I restart the services I expect it to start filling up the three indexes I have defined from the local Event Logs of the same name. This does happen, but really slowly - I think it Indexed about 300 Event Logs in 45 minutes.

Does anyone have any idea why this would be slow and how I might troubleshoot it?

Many thanks!

M

0 Karma
1 Solution

mshilston
Path Finder

OK, so after digging around it appears that it was indexing correctly, just that it wasn't re-reading old event logs due to the following files being present;

$SPLUNK_HOME\var\lib\splunk\modinputs\WinEventLog\

Once I cleared these out everything started working as expected 🙂

View solution in original post

0 Karma

mshilston
Path Finder

OK, so after digging around it appears that it was indexing correctly, just that it wasn't re-reading old event logs due to the following files being present;

$SPLUNK_HOME\var\lib\splunk\modinputs\WinEventLog\

Once I cleared these out everything started working as expected 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...