Splunk® Supported Add-ons

Splunk Add-on for Microsoft Office 365

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Performance reference for the Management Activity input in the Splunk Add-on for Microsoft Office 365

The following tables contain reference information about Splunk's performance testing of the Management Activity input in the Splunk Add-on for Microsoft Office 365. Use this information to enhance the performance of your own Management Activity data collection tasks.

Many factors impact performance results, including deployment architecture, and hardware. These results represent reference information and do not represent performance in all environments.

Management Activity input performance characteristics

Version 4.3.0 performance statistics

Common architecture setup Time Taken for Data Collection No. of Events No. of Threads HF/IDM Average CPU (%) HF/IDM Average RAM (%)
On Prem
  • Heavy Forwarder (m5.4xlarge)
    • 16 CPU
    • 64 GiB Memory
14min 5M 4 7.40% 0.08%
9min 5M 32 15% 0.31%
CO2 Stack - Classic Cluster (1 IDM)
  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory
  • 1 Input Data Manager (IDM) (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
19min 5M 4 38% 0.19%
18min 5M 32 50.54% 0.62%
CO2 Stack - Victoria Search Head Cluster
  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory
14min 5M 4 20% 0.18%
12min 5M 32 27% 0.62%

Version 4.3.0 vs 4.2.1 performance comparison statistics

Common architecture setup TA Version Time Taken for Data Collection No. of Events No. of Threads HF/IDM Average CPU (%) HF/IDM Average RAM (%)
On Prem
  • Heavy Forwarder (m5.4xlarge)
    • 16 CPU
    • 64 GiB Memory
v4.3.0 2min 500K 4 3.84% 0.05%
v4.2.1 51min 500K 4 4.76% 0.05%
CO2 Stack - Classic Cluster (1 IDM)
  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory
  • 1 Input Data Manager (IDM) (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
v4.3.0 1min 47sec 500K 4 36% 0.15%
v4.2.1 4hr 48min 500K 4 7.50% 0.18%
CO2 Stack - Victoria Search Head Cluster
  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory
v4.3.0 1min 25sec 500K 4 17.48% 0.16%
v4.2.1 4hr 45min 500K 4 2.45% 0.19%
Last modified on 20 February, 2024
PREVIOUS
Troubleshoot the Splunk Add-on for Microsoft Office 365
 

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters