How incoming data affects Splunk performance
This topic discusses how incoming data impacts Splunk indexing performance.
A reference Splunk indexer can index a significant amount of data in a short period of time - up to 5.8 MB of data per second - or 500 GB per day. This is if the server is doing nothing else but consuming data.
Performance changes depending on the size and amount of incoming data. Larger events slow down indexing performance. As events increase in size, the indexer uses more system memory to process and index them.
If you need more indexing capacity than a single indexer can provide, you must add indexers into the deployment to account for the increased demand.
Hardware capacity planning for your Splunk deployment
How indexed data impacts Splunk performance
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18