Stream forwarder sizing guide
For Splunk Stream running on Splunk Enterprise 8.0 and later, the maximum number of Stream forwarders that a search head can support depends on the value of the:
server thread_pool sizeparameter in
The following table shows the number of stream forwarders supported for various
thread_pool size and server instance types.
pingInterval value is 5 seconds by default. Make sure to have at least 10% of your search head server CPU available to handle the Stream forwarder ping load.
|Instance Type||thread_pool||Number of Forwarders|
|C5 36 cores (9xl)||60||330|
|C5 16 cores (4xl)||40||170|
|C5 8 cores (2xl)||30||80|
C5 CPU is an Intel Xeon Platinum 8000 series processor (Skylake-SP or Cascade Lake) with a sustained all core Turbo CPU clock speed of up to 3.6 GHz.
You can change the Splunk platform app server
thread_pool size in
web. conf [settings] server.thread_pool =
Configure the number of Stream forwarders that Splunk App for Stream can support
The maximum number of Stream forwarders (
streamfwd) that a search head can support depends on the value of the
pingInterval parameter in
pingInterval setting is 5 seconds. To increase the number of forwarders that a search head can handle, increase the
pingInterval setting in
streamfwd.conf to a larger number. Peak activity can occur during startup up or when stream configuration changes are made.
If your deployment includes a large number of Stream forwarders, run
splunk_app_stream on a dedicated server and stagger the startup of individual Stream forwarders over time. Starting up too many Stream forwarders simultaneously can overload the server.
Flow collector performance test results
Splunk Stream REST API reference
This documentation applies to the following versions of Splunk Stream™: 7.3.0, 7.4.0, 8.0.0