Stream forwarder sizing guide
For Splunk Stream running on Splunk Enterprise 8.0 and later, the maximum number of Stream forwarders that a search head can support depends on the value of the:
pingIntervalparameter instreamfwd.confserver thread_pool sizeparameter inweb.conf
The following table shows the number of stream forwarders supported for various thread_pool size and server instance types.
pingInterval value is 5 seconds by default. Make sure to have at least 10% of your search head server CPU available to handle the Stream forwarder ping load.| Instance Type | thread_pool | Number of Forwarders |
|---|---|---|
| C5 36 cores (9xl) | 60 | 330 |
| C5 16 cores (4xl) | 40 | 170 |
| C5 8 cores (2xl) | 30 | 80 |
C5 CPU is an Intel Xeon Platinum 8000 series processor (Skylake-SP or Cascade Lake) with a sustained all core Turbo CPU clock speed of up to 3.6 GHz.
You can change the Splunk platform app server thread_pool size in web.conf.
web. conf
[settings]
server.thread_pool =
Configure the number of Stream forwarders that Splunk App for Stream can support
The maximum number of Stream forwarders (streamfwd) that a search head can support depends on the value of the pingInterval parameter in streamfwd.conf.
The default pingInterval setting is 5 seconds. To increase the number of forwarders that a search head can handle, increase the pingInterval setting in streamfwd.conf to a larger number. Peak activity can occur during startup up or when stream configuration changes are made.
If your deployment includes a large number of Stream forwarders, run splunk_app_stream on a dedicated server and stagger the startup of individual Stream forwarders over time. Starting up too many Stream forwarders simultaneously can overload the server.