https://community.splunk.com/t5/Monitoring-Splunk/What-Splunk-stats-should-I-look-at-to-determine-if-my-indexers/m-p/245274#M8025 <P>There are a few different factors here you should consider depending on whether you are talking about search, index, or batch pipelines.</P> <P>These general rules can generally be applied. What you should be looking at is general CPU, Memory, and Disk I/o on your indexer/HF over a historical period and compare to your system utilization. If you have the system resources available, you can enable this. However, if there is any general concern that you are resource quenched, dont touch this...</P> <P>SoS is technically usable, but deprecated. You should be looking at DMC.</P> <P>Docs : <A href="http://docs.splunk.com/Documentation/Splunk/6.4.0/Capacity/Parallelization">http://docs.splunk.com/Documentation/Splunk/6.4.0/Capacity/Parallelization</A></P> Wed, 11 May 2016 06:03:17 GMT esix_splunk 2016-05-11T06:03:17Z https://community.splunk.com/t5/Monitoring-Splunk/What-Splunk-stats-should-I-look-at-to-determine-if-my-indexers/m-p/245273#M8024 <P>Hi,</P> <P>What Splunk stats should we look at to determine if our indexers are candidate for multiple pipelines? SoS cpu usage? </P> Wed, 11 May 2016 02:33:48 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-Splunk-stats-should-I-look-at-to-determine-if-my-indexers/m-p/245273#M8024 a212830 2016-05-11T02:33:48Z https://community.splunk.com/t5/Monitoring-Splunk/What-Splunk-stats-should-I-look-at-to-determine-if-my-indexers/m-p/245274#M8025 <P>There are a few different factors here you should consider depending on whether you are talking about search, index, or batch pipelines.</P> <P>These general rules can generally be applied. What you should be looking at is general CPU, Memory, and Disk I/o on your indexer/HF over a historical period and compare to your system utilization. If you have the system resources available, you can enable this. However, if there is any general concern that you are resource quenched, dont touch this...</P> <P>SoS is technically usable, but deprecated. You should be looking at DMC.</P> <P>Docs : <A href="http://docs.splunk.com/Documentation/Splunk/6.4.0/Capacity/Parallelization">http://docs.splunk.com/Documentation/Splunk/6.4.0/Capacity/Parallelization</A></P> Wed, 11 May 2016 06:03:17 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-Splunk-stats-should-I-look-at-to-determine-if-my-indexers/m-p/245274#M8025 esix_splunk 2016-05-11T06:03:17Z https://community.splunk.com/t5/Monitoring-Splunk/What-Splunk-stats-should-I-look-at-to-determine-if-my-indexers/m-p/245275#M8026 <P>Thanks. We are at 6.1, so I'm still using SoS, but this matches what I thought, exactly. Can't wait. Thanks!</P> Wed, 11 May 2016 11:03:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/What-Splunk-stats-should-I-look-at-to-determine-if-my-indexers/m-p/245275#M8026 a212830 2016-05-11T11:03:09Z