How Splunk apps affect Splunk Enterprise performance
This topic discusses how Splunk apps impact overall Splunk Enterprise performance on a single reference indexer.
While many apps can run on a single indexer - Splunk Enterprise actually runs several included with the product - the more things an app does, the more likely you must distribute it across multiple machines.
Many apps require a distributed Splunk Enterprise deployment by design. Whether it's a case of universal forwarders fetching data and sending it to a single central instance, or many indexers and search heads connected together and serving up reports, dashboards, or alerts, Splunk apps often need more than one server to realize both maximum performance and potential in the enterprise.
How search types impact Splunk Enterprise performance
How Splunk Enterprise calculates disk storage
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14