Stream forwarder sizing guide
For Splunk Stream running on Splunk Enterprise 8.0 and later, the maximum number of Stream forwarders that a search head can support depends on the value of the:
pingInterval
parameter instreamfwd.conf
server thread_pool size
parameter inweb.conf
The following table shows the number of stream forwarders supported for various thread_pool
size and server instance types.
The pingInterval
value is 5 seconds by default. Make sure to have at least 10% of your search head server CPU available to handle the Stream forwarder ping load.
Instance Type | thread_pool | Number of Forwarders |
---|---|---|
C5 36 cores (9xl) | 60 | 330 |
C5 16 cores (4xl) | 40 | 170 |
C5 8 cores (2xl) | 30 | 80 |
C5 CPU is an Intel Xeon Platinum 8000 series processor (Skylake-SP or Cascade Lake) with a sustained all core Turbo CPU clock speed of up to 3.6 GHz.
You can change the Splunk platform app server thread_pool
size in web.conf
.
web. conf [settings] server.thread_pool =
Configure the number of Stream forwarders that Splunk App for Stream can support
The maximum number of Stream forwarders (streamfwd
) that a search head can support depends on the value of the pingInterval
parameter in streamfwd.conf
.
The default pingInterval
setting is 5 seconds. To increase the number of forwarders that a search head can handle, increase the pingInterval
setting in streamfwd.conf
to a larger number. Peak activity can occur during startup up or when stream configuration changes are made.
If your deployment includes a large number of Stream forwarders, run splunk_app_stream
on a dedicated server and stagger the startup of individual Stream forwarders over time. Starting up too many Stream forwarders simultaneously can overload the server.
Flow collector performance test results | Splunk Stream REST API reference |
This documentation applies to the following versions of Splunk Stream™: 7.3.0, 7.4.0, 8.0.0
Feedback submitted, thanks!