uberAgent for Splunk is Here

When sizing a new environment it is tempting to use averages. It seems the logical thing to do. But it also guarantees a bad user experience. Example: Sizing an RDS or XenApp Farm Let’s say you’re tasked with building a new Citrix XenApp farm. Being a diligent IT person you set up a pilot: one or two machines with all the right software and settings. Then you carefully select a group of pilot users in such a way that they represent the organization’s employee types statistically correctly. Then you let them work on the new platform, ironing out bugs and such. At the end of that period, you have a great new platform. But there is one big question left: how many servers to buy?!

One of the (many) great things about Splunk is that data, once indexed, is not being tampered with. Of course, you can choose for how long you want to retain your data, but Splunk won’t go and average multiple older events into one, because that would flatten peaks and remove potentially important detail.