Monitoring Splunk

Looking for "high performance Splunk"

Jason
Motivator

A client is looking for advice on tuning splunk for what they call "high performance" - defined as minimizing cpu, network transfer, disk IO.

I have been under the impression that the defaults are some of the best settings for general use, and I know the limits.conf maxKBps value will limit network traffic emitted from a forwarder.

Are there any other tunable settings you use to optimize CPU or disk use?

Tags (3)
0 Karma
1 Solution

Genti
Splunk Employee
Splunk Employee

If you are talking about the indexer then I think you are mixing two ideas here.
The first one is being HIGH SPLUNK PERFORMANCE, that is, Splunk works fast, Splunk indexes fast, Splunk searches fast, Splunk does everything fast. If this is what you want, then you need Lots of CPU Power, Lots of RAM, FAST Disk IO and FAST network. And more importantly, you want all of the above because you want Splunk to USE all that power.

If you want splunk not to use PC resources, then do not index too much data, do not run heavy and dense searches, do not run realtime searches, do not allow more then one user at a time, do not do regex extractions while indexing etc..etc..

The idea here is, it really depends on the load you want to put on splunk. If you want Splunk to do heavy work, then you should be willing to allow it and enable it to do so with good hardware.

View solution in original post

Genti
Splunk Employee
Splunk Employee

If you are talking about the indexer then I think you are mixing two ideas here.
The first one is being HIGH SPLUNK PERFORMANCE, that is, Splunk works fast, Splunk indexes fast, Splunk searches fast, Splunk does everything fast. If this is what you want, then you need Lots of CPU Power, Lots of RAM, FAST Disk IO and FAST network. And more importantly, you want all of the above because you want Splunk to USE all that power.

If you want splunk not to use PC resources, then do not index too much data, do not run heavy and dense searches, do not run realtime searches, do not allow more then one user at a time, do not do regex extractions while indexing etc..etc..

The idea here is, it really depends on the load you want to put on splunk. If you want Splunk to do heavy work, then you should be willing to allow it and enable it to do so with good hardware.

rotten
Communicator

Are you talking about minimizing the forwarder footprint, or maximizing the Indexer performance?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...