https://community.splunk.com/t5/Getting-Data-In/heavy-forwarder-multi-core/m-p/470911#M80939 <P>If you increase the parallel ingestion pipelines on the forwarder (default = 1), it will utilize one core per pipeline.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipeline_sets">https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipeline_sets</A></P> <P>One caveat worth noting, when handling compressed files (.gz) the forwarder will utilize a single pipeline only, regardless of the pipeline setting.</P> Wed, 12 Feb 2020 16:28:36 GMT codebuilder 2020-02-12T16:28:36Z https://community.splunk.com/t5/Getting-Data-In/heavy-forwarder-multi-core/m-p/470909#M80937 <P>Hi,</P> <P>I see a few similar questions in the past however I can't see an answer to date. </P> <P>Does anyone know if the splunkd process can utilise modern multicore cpu architectures? or is it bound to a single thread of execution?</P> <P>The splunk ingest pipeline looks to me (as a non-programmer) as something that might lend itself to multi-threading. </P> <P>Thanks,<BR /> David</P> Wed, 12 Feb 2020 10:48:39 GMT https://community.splunk.com/t5/Getting-Data-In/heavy-forwarder-multi-core/m-p/470909#M80937 danan5 2020-02-12T10:48:39Z https://community.splunk.com/t5/Getting-Data-In/heavy-forwarder-multi-core/m-p/470910#M80938 <P>see here:<BR /> <A href="https://answers.splunk.com/answers/12027/single-multi-threading-cpu.html">https://answers.splunk.com/answers/12027/single-multi-threading-cpu.html</A></P> <P>maybe this will help as well:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Capacity/Parallelization">https://docs.splunk.com/Documentation/Splunk/8.0.1/Capacity/Parallelization</A></P> Wed, 12 Feb 2020 13:39:40 GMT https://community.splunk.com/t5/Getting-Data-In/heavy-forwarder-multi-core/m-p/470910#M80938 adonio 2020-02-12T13:39:40Z https://community.splunk.com/t5/Getting-Data-In/heavy-forwarder-multi-core/m-p/470911#M80939 <P>If you increase the parallel ingestion pipelines on the forwarder (default = 1), it will utilize one core per pipeline.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipeline_sets">https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipeline_sets</A></P> <P>One caveat worth noting, when handling compressed files (.gz) the forwarder will utilize a single pipeline only, regardless of the pipeline setting.</P> Wed, 12 Feb 2020 16:28:36 GMT https://community.splunk.com/t5/Getting-Data-In/heavy-forwarder-multi-core/m-p/470911#M80939 codebuilder 2020-02-12T16:28:36Z