https://community.splunk.com/t5/Splunk-Search/Where-is-the-bottleneck/m-p/79539#M20132 <P>Your indexer IOPS is fairly low, their cores likely are bored to death.</P> <P>The number of cores on the search heads will limit the number of searches you can run concurrently, indeed.</P> Fri, 29 Mar 2013 22:09:35 GMT martin_mueller 2013-03-29T22:09:35Z https://community.splunk.com/t5/Splunk-Search/Where-is-the-bottleneck/m-p/79538#M20131 <P>We are having minor performance issues with our deployment and I would like an outside opinion on where the bottleneck might be. Our current deployment looks like this;</P> <P>Splunk 5.0.1</P> <P>2 Search Heads - Virtual; 4 CPU Cores Each; 6 GB RAM</P> <P>1 Master Node - Virtual; 2 CPU Cores; 4 GB RAM; </P> <P>2 Indexers - Physical; 24 CPU Cores; 24 GB RAM; 350 IOPS per server</P> <P>I suspect the biggest issue is the number of CPU cores on the search heads, does anyone see another constraint I have missed?</P> Fri, 29 Mar 2013 19:45:27 GMT https://community.splunk.com/t5/Splunk-Search/Where-is-the-bottleneck/m-p/79538#M20131 rmcdougal 2013-03-29T19:45:27Z https://community.splunk.com/t5/Splunk-Search/Where-is-the-bottleneck/m-p/79539#M20132 <P>Your indexer IOPS is fairly low, their cores likely are bored to death.</P> <P>The number of cores on the search heads will limit the number of searches you can run concurrently, indeed.</P> Fri, 29 Mar 2013 22:09:35 GMT https://community.splunk.com/t5/Splunk-Search/Where-is-the-bottleneck/m-p/79539#M20132 martin_mueller 2013-03-29T22:09:35Z