A client is looking for advice on tuning splunk for what they call "high performance" - defined as minimizing cpu, network transfer, disk IO.
I have been under the impression that the defaults are some of the best settings for general use, and I know the limits.conf maxKBps value will limit network traffic emitted from a forwarder.
Are there any other tunable settings you use to optimize CPU or disk use?
If you are talking about the indexer then I think you are mixing two ideas here.
If you want splunk not to use PC resources, then do not index too much data, do not run heavy and dense searches, do not run realtime searches, do not allow more then one user at a time, do not do regex extractions while indexing etc..etc..
The idea here is, it really depends on the load you want to put on splunk. If you want Splunk to do heavy work, then you should be willing to allow it and enable it to do so with good hardware.
answered 05 Nov '10, 23:58