Getting Data In

how to speed the files input process

cyue_splunk
Splunk Employee
Splunk Employee

If I have a directory containing many files to be added for file monitoring inputs, Splunk reads the files one by one. It'll take a long time if the files have a big size. Is there any way Splunk can read multiple files simultaneously to improve the inputs speed(not with multiple forwarders, just for one Splunk instance or one Forwarder instance )? Thanks!

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

Not really, splunk indexers already go full speed by default.

Check your indexing queues queues with the sos app to find any bottleneck.
One remark about universal and lighweight forwarders : they have a limit of 256 kbps for the network speed. You can remove this limit.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...