topic Re: Increase use core by splunk in Getting Data In

Increase use core by splunk

ips_mandar — Wed, 19 Feb 2020 11:06:01 GMT

Hi all,
I am using Heavy forwarder (splunk version 8.0.1 and os-windows) to ingest .zip log files but I could see very less cores are getting used which is around 2 to 3 .although Heavy forwarder has 8 cores available . So how can I make setting to use all cores by splunk.
Also I have increased parallelingestion pipelines to 2.
So is there any setting by which I can increase cores used by splunk?
Thanks,

Re: Increase use core by splunk

adonio — Wed, 19 Feb 2020 13:01:31 GMT

check out this answer:
https://answers.splunk.com/answers/803148/heavy-forwarder-multi-core.html#answer-801919

Re: Increase use core by splunk

DavidHourani — Wed, 19 Feb 2020 13:44:21 GMT

Hi @ips_mandar,

You got the right setting, the number of cores used is equivalent to the value you set in parallelIngestionPipelines. So if you'd like to use more cores simply increase that value in server.conf and you're all set.

Let us know if you need more help.

Cheers,
David

Re: Increase use core by splunk

nickhills — Wed, 19 Feb 2020 14:07:43 GMT

Regardless of how many cores or pipelines you have configured, compressed file ingestion only ever uses 1 core.
Other sources will use any additional available pipelines as long as they do not also contain compressed files.

In short, Splunk forwarders can only process one archived file at a time, hence the usage patterns you are seeing