Clicky

What is the indexing load of Layer8Insight with / without perfmon data?

The Layer8Insight agents only produce data when there is user activity on a host. Given that and Layer8Insight's event-driven nature, the Layer8Insight agents typically produce about 0.5 MB of raw data per user per working day. The actual amount will vary depending on the amount of user activity and the diversity of some applications.

The Layer8Insight App for Splunk is pre-built to integrate perfmon data and Windows event log data with Layer8Insight data. If you are using the Splunk Universal Forwarder / Splunk TA for Windows to collect perfmon and Windows event log data from a desktop end-user, your data volume will be much higher depending on the data collection configuration.

Assuming you are using the Splunk Universal Forwarder / Splunk TA for Windows default configuration and a 60 second sampling period, the indexing volume will probably be between 5 to 6 MB per user per day with Layer8Insight and the machine data.

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.
Powered by Zendesk