Skip to content

Commit

Permalink
Update performance.md
Browse files Browse the repository at this point in the history
  • Loading branch information
mkarlstrand-splunk authored and GitHub committed Oct 7, 2019
1 parent c8cab0e commit 27b552f
Showing 1 changed file with 5 additions and 6 deletions.
11 changes: 5 additions & 6 deletions docs/performance.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,16 +22,15 @@ average rate = 9717.58 msg/sec, count=1749420, time=180.026, (average) msg size=

## Limitations

Splunk Enterprise's implementation of the http event collection server responds to the client with a status code 200 and
fails to commit the events to disk during a rolling restart. In our testing, 20-30 events per indexer are lost.
In our tests, if Splunk Enterprise’s implementation of the http event collection server responded to the client with a status code 200 and failed to commit the events to disk during a rolling restart, then 20-30 events per indexer were lost.

## Guidance on sizing hardware

The following reference deployment hardware specifications are based on Splunk performance testing results in AWS
The following reference deployment hardware specifications are based on Splunk performance testing results in Amazon Web Services.
The overall load on your deployment hardware will vary based on the percentage of events not handled by a filter or use of
exceptionally complex regex in filters. While we consider the following conservative actual hardware performance will vary
due to network interface card, driver, kernel version, exact CPU even type of memory and configuration. SYSLOG is a fire
and forget protocol making it sensitive to performance. Given this it is highly recommended you should validate
exceptionally complex regex in filters. While we consider the following conservative, actual hardware performance will vary
due to network interface card, driver, kernel version, exact CPU, type of memory and configuration. SYSLOG is a fire
and forget protocol making it sensitive to performance. Given this it is highly recommended that you validate
performance with your hardware and production data samples. The syslog-ng loggen tool available in the SC4S container
and the commands above can be utilized in this effort.

Expand Down

0 comments on commit 27b552f

Please sign in to comment.