Performance reference for the Azure Event Hub input in the Splunk Add-on for Microsoft Cloud Services

The following tables contain reference information about performance testing of the Azure Event Hub input in the Splunk Add-on for Microsoft Cloud Services. Use this information to enhance the performance of your own Azure Event Hub data collection tasks.

Many factors impact performance results, including file size, file compression, event size, deployment architecture, batch size for Event Hub file size, and hardware. Results represent reference information and do not represent performance in all environments.

Version 5.0.0 Event Hub performance characteristics

Common architecture setup	Scenario	Event type	Event Size	Ingest Rate	IDM CPU
Splunk platform environment - Victoria Search Head Cluster 1 cluster master (c5.xlarge) 3 search heads (m5.2xlarge) 8 CPU core 16 GB RAM 3 indexers (i3.4xlarge) 16 CPU core 122 GB RAM Default TA configs	1 input 16 partition eventhub	Non-JSON	1 KB	2124 kb/s	N/A
	16 inputs 16 partition eventhub	Non-JSON	1 KB	7018 kb/s	N/A
	1 input 32 partition eventhub	Non-JSON	1 KB	2124 kb/s	N/A
	32 inputs 32 partition eventhub	Non-JSON	1 KB	4093 kb/s	N/A
Splunk platform environment - Classic Cluster (1 IDM) 1 cluster master (c5.xlarge) 3 search heads (c6i.xlarge) 4 CPU core 8 GB RAM 3 indexers (i3.large) 2 CPU core 15.25 GB RAM 1 Input Data Manager (IDM) (r6i.xlarge) 4 CPU core 32 GB RAM Default TA configs	1 input 16 partition eventhub	Non-JSON	1 KB	1947 kb/s	30.60%
	16 inputs 16 partition eventhub	Non-JSON	1 KB	1949 kb/s	13%
	1 input 32 partition eventhub	Non-JSON	1 KB	1845 kb/s	30%
	32 inputs 32 partition eventhub	Non-JSON	1 KB	1380 kb/s	20%

Version 4.1.5 Event Eub performance characteristics

See the following performance testing data for the previous version 4.1.5.

Event Hub input performance characteristics

Common Setup	Event type	Event size	Scenario	Ingest rate	Data lag	IDM CPU	Index CPU	Bottleneck
2 add-on inputs 2 Event Hub partitions Default Splunk Cloud platform environment 1 cluster master (c5.xlarge) 1 search head (c5.2xlarge) 3 indexer cluster (i3.large) 1 Inputs Data Manager (IDM) (r5.xlarge) default TA configs 1 IDM (4 cores, 32 GB memory)
	JSON	1 KB	Sweet Spot	187 GB/Day (2200 eps)	4 seconds	50-89%	86-92%	IDX CPU utilized
	Non-JSON (mcas-cef)	994 bytes	Sweet Spot	133 GB/day (2000 eps)	8 seconds	65-94%	99%	IDX CPU utilized

Event Hub Scale Up performance characteristics

Environment setup

Cluster setup	Event Hub namespace	Event Hub	Add-on inputs	Splunk software configurations
Scaled up Splunk Cloud platform environment 1 cluster master (c5.xlarge) 1 search head (c5.9xlarge) 3 indexer cluster (i3.8xlarge) 32 CPU cores 244 GB memory 2 Input Data Manager (c5.9xlarge) 36 CPU cores 72 GB memory	2 Event Hub namespaces 40 throughput units (TU) on each namespace 80 throughput units (TU) in total (2*40)	2 Event Hubs per namespace 4 Event Hubs in total (2*2) 20 partitions per Event Hub 80 partitions in total (4*20)	80 inputs in total (2*40) 40 inputs per add-on 2 add-on installed on Inputs Data Manager default add-on configurations max wait 10s batch size 300 1 add-on pulls from 1 namespace only 1 add-on pulls from 2 Event Hubs on same namespace 40 inputs on each add-on 20 inputs on each Event Hub (20 partitions)	Inputs Data Manager and indexer configuration parallelIngestionPipelines = 8

Scale up result summary

Event type	Number of inputs	Event size	Scenario	Ingest rate	Ingest Events per second	Max index rate	Data lag in seconds	Inputs Data Manager (IDM) CPU %	IDM CPU Cores % (Percentage of total IDM cores)	Indexer CPU %
JSON	80	1 Kb	Sweet Spot	6.106 TB/day	78K	7.55 TB/day	4s	51%	36%	30.5%
JSON	10	1 Kb	Sweet Spot	1.764 TB/day	20.8K	2.19 TB/day	9s	24%	8.6%	10%
Non JSON	80	0.998 Kb	Sweet Spot	5.555 TB/day	83.2K	7.22 TB/day	4s	67%	48%	47%
Non JSON	10	0.998 Kb	Sweet Spot	1.595 TB/day	24K	2.07 TB/day	3s	29%	10.4%	11%