Skip to content

Performance reference for the Management Activity input in the Splunk Add-on for Microsoft Office 365

The following tables contain reference information about Splunk’s performance testing of the Management Activity input in the Splunk Add-on for Microsoft Office 365. Use this information to enhance the performance of your own Management Activity data collection tasks.

Note

Many factors impact performance results, including deployment architecture, and hardware. These results represent reference information and do not represent performance in all environments.

Management Activity input performance characteristics

Version 4.3.0 performance statistics

Common architecture setup

Time Taken for Data Collection

No. of Events

No. of Threads

HF/IDM Average CPU (%)

HF/IDM Average RAM (%)

On Prem

  • Heavy Forwarder (m5.4xlarge)
    • 16 CPU
    • 64 GiB Memory

14min

5M

4

7.40%

0.08%

9min

5M

32

15%

0.31%

CO2 Stack - Classic Cluster (1 IDM)

  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory
  • 1 Input Data Manager (IDM) (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory

19min

5M

4

38%

0.19%

18min

5M

32

50.54%

0.62%

CO2 Stack - Victoria Search Head Cluster

  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory

14min

5M

4

20%

0.18%

12min

5M

32

27%

0.62%

Version 4.3.0 vs 4.2.1 performance comparison statistics

Common architecture setup

TA Version

Time Taken for Data Collection

No. of Events

No. of Threads

HF/IDM Average CPU (%)

HF/IDM Average RAM (%)

On Prem

  • Heavy Forwarder (m5.4xlarge)
    • 16 CPU
    • 64 GiB Memory

v4.3.0

2min

500K

4

3.84%

0.05%

v4.2.1

51min

500K

4

4.76%

0.05%

CO2 Stack - Classic Cluster (1 IDM)

  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory
  • 1 Input Data Manager (IDM) (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory

v4.3.0

1min 47sec

500K

4

36%

0.15%

v4.2.1

4hr 48min

500K

4

7.50%

0.18%

CO2 Stack - Victoria Search Head Cluster

  • 1 cluster master (c5.xlarge)
  • 3 search heads (m6i.4xlarge)
    • 16 CPU
    • 64 GiB Memory
  • 3 indexer clusters (is4gen.4xlarge)
    • 16 CPU
    • 96 GiB Memory

v4.3.0

1min 25sec

500K

4

17.48%

0.16%

v4.2.1

4hr 45min

500K

4

2.45%

0.19%