Stream forwarder sizing guide

For Splunk Stream running on Splunk Enterprise 8.0 and later, the maximum number of Stream forwarders that a search head can support depends on the value of the:

• pingInterval parameter in streamfwd.conf
• server thread_pool size parameter in web.conf

The following table shows the number of stream forwarders supported for various thread_pool size and server instance types.

The pingInterval value is 5 seconds by default. Make sure to have at least 10% of your search head server CPU available to handle the Stream forwarder ping load.

Instance Type	thread_pool	Number of Forwarders
C5 36 cores (9xl)	60	330
C5 16 cores (4xl)	40	170
C5 8 cores (2xl)	30	80

C5 CPU is an Intel Xeon Platinum 8000 series processor (Skylake-SP or Cascade Lake) with a sustained all core Turbo CPU clock speed of up to 3.6 GHz.

You can change the Splunk platform app server thread_pool size in web.conf.

web. conf 
[settings]
server.thread_pool =

Configure the number of Stream forwarders that Splunk App for Stream can support

The maximum number of Stream forwarders (streamfwd) that a search head can support depends on the value of the pingInterval parameter in streamfwd.conf.

The default pingInterval setting is 5 seconds. To increase the number of forwarders that a search head can handle, increase the pingInterval setting in streamfwd.conf to a larger number. Peak activity can occur during startup up or when stream configuration changes are made.

If your deployment includes a large number of Stream forwarders, run splunk_app_stream on a dedicated server and stagger the startup of individual Stream forwarders over time. Starting up too many Stream forwarders simultaneously can overload the server.