Splunk® Edge Hub OS

Setup and Configuration Guide

For documentation on other necessary components for Splunk Edge Hub, see the Splunk App for Edge Hub documentation, Splunk Edge Hub mobile app documentation, and Splunk Edge Hub hardware documentation.

Splunk Edge Hub OS data handling

The following topic describes Splunk Edge Hub OS memory capacity, data groups, data streamer processes, and how backlog data is handled.

On-board memory capacity

The latest version of Splunk Edge Hub OS offers 32 GB of on-board memory, 3GB of which are used by the operating system.

Data groups

The following table lists the data groups that Splunk Edge Hub OS handles, their formats, and the index for ingesting the data:

Data group Format Default Index
Sensors Metric edge_hub_data
Anomalies Metric edge_hub_data
Health Metric edge_hub_status
Logs Event edge_hub_logs
SNMP Event edge_hub_snmp
OPC-UA Event edge_hub_opcua
Modbus Event edge_hub_modbus

Data streamer process

Each data group has a separate data streamer process and follows a custom configuration. Currently, Splunk Edge Hub OS does not support using a universal forwarder.

The data streamers for sensors, health, and SNMP send batch requests of 10 items. The data streamer for logs sends batch requests of 5 items.

Splunk Edge Hub OS monitors if the Splunk App for Edge Hub is reachable every 15 seconds. If the app cannot be reached, the Splunk Edge Hub status light ring changes from green to red and the data streamers start to use SQLite database as a backlog.

Data backlog handling

Backlogs are separate for each data streamer. The health, log, anomalies, and SNMP backlogs support a total of 100,000 data points. The sensor backlog supports a total of 3 million data points. If the limit is reached, the oldest entries are deleted first.

After the network connection is restored, the status light ring returns to green. Splunk Edge Hub OS processes the backlog using FIFO. It starts a separate thread and processes a block of the oldest 10,000 entries by sending individual batch requests of 100 items to HTTP Event Collector (HEC). Splunk Edge Hub OS repeats this process until the backlog is empty.

The limits on how backlog requests are handled are hardcoded. These limits cannot be configured.

Last modified on 06 November, 2024
View Splunk Edge Hub data   Set up a private network for air-gapped registration

This documentation applies to the following versions of Splunk® Edge Hub OS: beta0.10.0, beta0.11.0, beta0.12.0, beta0.15.0, beta1.2, beta1.3.1, beta1.3.2, 1.4.2, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.9.0, 2.0.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters