Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Indexer Capacity Planning - linking indexing and search performance: how does one effect the office?

$
0
0
I'm attempting to plan an upgrade of our Splunk instance from an ancient 6.4.1 to a brand new 7.2 instance and as part of that I'm trying to work out what sort of capacity I need... So this seems like it should be an easy task - as I'm already ingesting data into a Splunk setup so I can get real stats on how many searches are being run and how much data is being ingested. However after reading the capacity planning documents I can't seem to find anything to indicate what the impact of running searchs has on indexed performance. For example there's the [reference host specification](http://docs.splunk.com/Documentation/Splunk/7.2.1/Capacity/Referencehardware) which gives an idea of what indexer performance I can expect if no searches are being made and there is also a [guide on resources used when searches are run] (http://docs.splunk.com/Documentation/Splunk/7.2.1/Capacity/Accommodatemanysimultaneoussearches). But nothing linking the two? If I'm ingesting 400gb of day per day and seem to averaging about 10 concurrent searchs per minute (during office hours) how will that impact the indexing rates of a refenence specification host?

Viewing all articles
Browse latest Browse all 47296

Trending Articles