topic Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched in Splunk Enterprise

Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched

payl_chdhry — Fri, 26 Feb 2021 07:29:06 GMT

Hi,

I am trying to understand a bit on how searches impact CPU usage on indexers.

Does one search uses one CPU core by default or does it depend on indexes being searched

Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched.

Note: It is single query, no subqueries.

Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched

scelikok — Fri, 26 Feb 2021 09:12:47 GMT

Hi @payl_chdhry,

Splunk search core usage does not depends on the indexes search, always one core as default. It is normal high cpu usage on search over multiple indexes or large time-range because it is working more buckets.

Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched

payl_chdhry — Fri, 26 Feb 2021 14:54:08 GMT

Thanks @scelikok for your response.

Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size).

We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.

Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched

gjanders — Sat, 27 Feb 2021 07:20:35 GMT

While it's not exact the introspection logs record cpu usage in alerts for splunk admins https://splunkbase.splunk.com/app/3796/ I have dashboards such as troubleshooting resource usage per user https://github.com/gjanders/SplunkAdmins/blob/master/default/data/ui/views/troubleshooting_resource_usage_per_user.xml

Which can find cpu information per search