SplunkIt on EC2

How does Splunk perform running on Amazon EC2? Which instance types work best? We can answer these questions with, yes, SplunkIt.  Recently, we ran SplunkIt on 3 different configurations of EC2 to figure out which one was the best “bang for the buck”. The following table records the Index and Search Test results, along with the hourly cost of each instance type for our region (accurate as of when we ran the test):

On first glance, the m2.4xlarge instance is the clear winner – has the best indexing and search performance. However, looking in slightly more detail you can see it gives us about 34% higher indexing throughput than the c1.xlarge instance but for almost 3 times the price. Additionally, …

» Continue reading

Some SplunkIt Results

We had the chance to run SplunkIt on some commodity hardware available in our lab and wanted to share the results.

SplunkIt provides a standalone average indexing throughput, which in our case was 21,600 KBPS. It also provides this throughput metric calculated in events per second, and we measured 73,409 EPS.

Other performance metrics we obtain from running SplunkIt are (1) the amount of time it takes to get the first response or first set of events, and (2) the amount of time it takes to completely process the search request. In this run, it took an average of 632 ms to get the first event, and 16,512 ms to return all events from the search.

Note that as the …

» Continue reading

SplunkIt – The Splunk Performance Test Kit

Many people ask us about the performance of Splunk, usually in very generic terms. That can be a very open-ended question, but we are sure that it will be a lot easier to answer now that we have SplunkIt.

SplunkIt is a test kit that allows you to measure Splunk’s index and search performance. It generates a specific set of data for Splunk to index, and then simulates a user requesting searches while under some indexing load. The searches follow a pattern, and the data being indexed is always the same. These characteristics make it a very powerful benchmark, which measures performance in a consistent and repeatable fashion.

By using SplunkIt you will be able to assess the effect of …

» Continue reading