A reference Splunk Enterprise indexer can index a significant amount of data in a short period of time: over 20 megabytes of data per second or over 1.7 terabytes per day. This level of indexing occurs if the server is doing nothing else but consuming data.
Because Splunk Enterprise instances do more than index, consider this figure the maximum throughput for an indexer. Performance changes depending on the size and amount of incoming data. Larger events slow down indexing performance. As events increase in size, the indexer uses more system memory to process and index them.
If you need more indexing capacity than a single indexer can provide, add indexers into the deployment to account for the increased demand.
See the topics in this chapter to learn how other factors impact this performance figure.
A reference Splunk Enterprise indexer can index a significant amount of data in a short period of time:
over 20 megabytes of data per second or over 1.7 terabytes per day. This level of indexing occurs if the server is doing nothing else but consuming data.Because Splunk Enterprise instances do more than index, consider this figure the maximum throughput for an indexer. Performance changes depending on the size and amount of incoming data. Larger events slow down indexing performance. As events increase in size, the indexer uses more system memory to process and index them.
If you need more indexing capacity than a single indexer can provide, add indexers into the deployment to account for the increased demand.
See the topics in this chapter to learn how other factors impact this performance figure.
Reference
https://docs.splunk.com/Documentation/Splunk/8.2.6/Capacity/HowincomingdataaffectsSplunkEnterpriseperformance