Product performance is impacted by various factors, depending on your deployment size and scale. You can use the following information as a high-level guide for understanding the factors that can impact your deployment sizing and the approximate impact they are likely to have on product performance.
This section provides information about the variables that can impact the product performance along with the levels of impact to each of the system resources, as follows:
Variables that impact product performance
|Variable||Impact on resources|
|Number of data collectors||Medium||Low||Medium||Medium|
|Number of tags defined for the data collectors||Medium||Low||Medium||Low|
|Number of fields added to the My Fields panel on the Search tab||High||None||None||Low|
|Number of fields specified in data patterns||Low||None||Medium||None|
|Number of unique field values in the My Fields panel on the Search tab||Low||High||High||High|
|Volume of data indexed per day||High||Low||High||High|
|Number of managed hosts||Low||None||None||None|
|Simple search commands |
(Search commands with nontabular output)
|Advanced search commands |
Requires high CPU utilization by the Indexer and Search components.
Avoid using high cardinality fields (fields with large number of unique values) in the
|Number of concurrent users||High||High||None||High|
|Number of notification alerts||Low||Low||None||Low||Notification alerts are meant for shorter time period searches.|
|Number of notification reports||Low||Low||None||Low||Notification reports are expected to range for medium time period searches.|
|Number of viewlets and views||Medium||Medium||None||Medium||Performance overhead of a viewlet is the same as that of a manual run of the saved search used for creating the viewlet.|
1 Processor utilization (CPU)
2 Memory utilization (RAM)
3 Storage utilization (disk space)
4 I/O transfer rate (disk read/write rate)
Use the information in this section to calculate the deployment size of the product in your environment.
This information is indicative and is available for reference purposes.
The following table describes some of the primary drivers that impact product performance, along with their approximate impact on sizing:
|Drivers||Considerations and impact|
An increase in the retention period impacts the memory and storage requirements for the Indexer.
Impact on memory
The product stores data in time-based indices (buckets). The capacity of each bucket can be calculated in terms of either volume of data or time duration (in hours).
For each index, the minimum amount of RAM required by the Indexer is approximately 21 MB.
By default, each day, data is indexed into 4 buckets of 6 hours each. For a 7-day retention period (the default), you need 4 (buckets) * 7 (retention in days) = 28 buckets.
The total RAM requirement = 28 (buckets) * 21 (MB per bucket) = 588 MB.
Impact on storage
For every 1-day increase in your retention period, you require an increase of 1.25 times the volume of incoming data (per day).
With a 7-day retention period (the default), if you are indexing 10 GB of data per day, your storage requirement can be calculated as 7 (retention in days) * 10 (incoming data in GB) * 1.25 = 87.5 GB
|Number of concurrent users|
Multiple threads are created for every search that is triggered. The time taken by each thread is minimal and is approximately an average of 0.5 CPU cores per user (for each search execution).
Each notification or viewlet execution is the equivalent of one search execution.
Impact on CPU
Parallel executions of search requests, viewlets, and notifications by concurrent users can impact the CPU utilization of your system. This factor is applicable to the Indexer and Search components.
Impact on memory
For every search that you execute, a certain amount of data is loaded to the memory, especially for fields (on the My Fields panel on the Search tab) and advanced search commands (for example,
For example, eight concurrent searches running field calculations for a high cardinality field against the same index at the same time will most likely require the same Java heap size as that of one field calculation. On the other hand, eight concurrent searches running field calculations for a high cardinality field against different indices at the same time requires around eight times the Java heap size of one field calculation.
Fields impact the Indexer memory, while advanced search commands impact the Console server memory.
No simple formula exists for calculating the impact of the number of concurrent users on memory.
|Volume of data indexed (per day)|
The volume of data indexed per day can impact your storage requirements.
Impact on memory
The product stores data in time-based indices (buckets). The capacity of each bucket can be calculated in terms of either volume of data or time duration (in hours). Every search performed has an impact on the memory of the Indexer. The bucket capacity plays an important role in helping you control the memory needs.
No index can contain more than 5 GB of data. If you want to index 20 GB of data per day, then 20 / 5 = 4 buckets per day.
Impact on storage
The storage required for your system is 1.25 times the volume of data (indexed per day) depending on the defined data-retention period.