![]() Optimizers fot the sake of optimizing itself end up running Gentoo and recompiling software whole weekend so that your machine boots two seconds faster. Sure, the parameters are tunable and are there for a reason but unless you have a real need for that - leave them be. Especially that you don't have any problems with your setup. You're focusing (and using your time worrying about) single element's efficiency when it's more reasonable to verify whether your overall architecture is solid. So I believe you're looking in the wrong place at the wrong moment - the famous quote popularized by Donald Knuth says that premature optimization is the root of all evil. Sure, given enough cpu's and iops you can increase number of ingestion pipelines (although the docs say that the increase in performance drops over the value of 2 - I haven't tested it personally) but you'll end up with a huge server which might even manage to index huge amount of data but you won't be able to search it because you have only one cpu per search available and no search peers to distribute the load across. Remember that indexing data is not everything that indexers do. You don't architect an environment with a single undexer and expect it to handle several terabytes of data per day. Not even regarding technicalities, because I didn't read it thoughrouly but design-wise. This is what I have read so far, but I am not 100% sure about some of them any advice would be great parallelIngestionPipelines = X (This is to be set on the HF and the Indexer, i think)ĭedicatedIoThreads=Y (To be set on the HF) All machines are on 56 threads with HT on - so I have lots of CPU free.ġst - How to I monitor the history of the data coming in from the HF->indexersĢnd - Can you share some settings for the heavy forwarder and the indexers please to get the data into Splunk the fastest ![]() ![]() Or if someone has a few settings that they know work. I am starting to read about ways to optimise this configuration, but I am not sure if I have all the settings. I am running a heavy forwarder with HEC and it is sending data to 3 indexers.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |