How indexed data impacts Splunk Enterprise performance
This topic discusses how data that has already been consumed by Splunk Enterprise affects performance.
Once Splunk Enterprise consumes data and places it into indexes, those indexes grow, taking up disk space. As the indexes grow and available disk space decreases, Splunk Enterprise takes more time to index incoming data because the indexer's disk subsystem takes more time to find space to store the data.
This impacts search as well. On a single indexer, disk throughput splits between indexing (which is ongoing) and search requests (which are interrupts based on requests scheduled by users.) As indexes grow, search slows down because not only does the disk subsystem need to account for search requests, it also needs to handle increasingly longer requests to store incoming data. Depending on the type of search, those kinds of requests can be very I/O-intensive.
How incoming data affects Splunk Enterprise performance
How the number of concurrent users impacts Splunk Enterprise performance
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14