How indexed data impacts Splunk performance
This topic discusses how data that has already been consumed by Splunk affects Splunk performance.
Once Splunk consumes data and places it into indexes, those indexes grow, taking up disk space. As the indexes grow and available disk space decreases, Splunk takes more time to index incoming data because the indexer's disk subsystem takes more time to find space to store the data.
This impacts search as well. On a single indexer, disk throughput splits between indexing (which is ongoing) and search requests (which are interrupts based on requests scheduled by users.) As indexes grow, search slows down because not only does the disk subsystem need to account for search requests, it also needs to handle increasingly longer requests to store incoming data. Depending on the type of search, those kinds of requests can be very I/O-intensive.
How incoming data affects Splunk performance
How the number of concurrent users impacts Splunk performance
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18