Splunk Stream

Installation and Configuration Manual

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Stream forwarder sizing guide

For Splunk Stream running on Splunk Enterprise 8.0 and later, the maximum number of Stream forwarders that a search head can support depends on the value of the:

  • pingInterval parameter in streamfwd.conf
  • server thread_pool size parameter in web.conf

The following table shows the number of stream forwarders supported for various thread_pool size and server instance types.

The pingInterval value is 5 seconds by default. Make sure to have at least 10% of your search head server CPU available to handle the Stream forwarder ping load.

Instance Type thread_pool Number of Forwarders
C5 36 cores (9xl) 60 330
C5 16 cores (4xl) 40 170
C5 8 cores (2xl) 30 80

C5 CPU is an Intel Xeon Platinum 8000 series processor (Skylake-SP or Cascade Lake) with a sustained all core Turbo CPU clock speed of up to 3.6 GHz.

You can change the Splunk platform app server thread_pool size in web.conf.

web. conf 
server.thread_pool =

Configure the number of Stream forwarders that Splunk App for Stream can support

The maximum number of Stream forwarders (streamfwd) that a search head can support depends on the value of the pingInterval parameter in streamfwd.conf.

The default pingInterval setting is 5 seconds. To increase the number of forwarders that a search head can handle, increase the pingInterval setting in streamfwd.conf to a larger number. Peak activity can occur during startup up or when stream configuration changes are made.

If your deployment includes a large number of Stream forwarders, run splunk_app_stream on a dedicated server and stagger the startup of individual Stream forwarders over time. Starting up too many Stream forwarders simultaneously can overload the server.

Last modified on 17 September, 2020
Flow collector performance test results
Splunk Stream REST API reference

This documentation applies to the following versions of Splunk Stream: 7.3.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters