High Performance

Splunk is the highest performance technology for indexing, searching and managing logs and IT data. It delivers higher indexing throughput, faster search speeds and denser storage than previous Splunk releases and 3-5 times the performance of other log management technologies and appliances.

Test results show that Splunk achieves 3.3 mbps throughput and consumes only 40% of the raw data size with all of its advanced processing and high density indexing enabled.

Turning off some of Splunk’s advanced features like automatic timestamp recognition and event typing has a moderate impact on performance and a negligible impact on storage requirements.

Lowering the density of indexing to just metadata like timestamp, host, source and source type, delivers a performance boost to a stunning 154,000 events per second, while squeezing storage requirements down to just 12% of the raw data size.

See the test design and set-up in the Splunk Performance Guide

This makes Splunk the highest performance choice for simple log retention when compared to log appliances that just store the data organized by time with no indexing at all, yet typically deliver only 20,000-50,000 events per second throughput.

Testing was performed on a 2 CPU Intel Xeon Server with 4GB of RAM.

* This configuration is not comparable to any other log data technology or log appliance.
** This configuration is most directly comparable to log appliances that use commodity document indexing technologies to provide basic text indexing.
*** This configuration is most directly comparable to log storage appliances, but Splunk still delivers faster search and better performance.