topic Re: How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)? in Splunk Search

How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

deodion — Wed, 03 Aug 2016 05:00:58 GMT

How does Splunk assign processor cores to execute a job like running script, scheduled search, ad hoc search, etc.

Let's say I have in total 2 sockets x 8 cores = 16 cores,
each core has 2 logical cores, so in total it has 32 logical cores (threads)

My question:
- Does Splunk use the physical core or logical core for any Splunk job?
- How does Splunk assign it to do the job? I mean is it random or round robin thing or how?

Thanks,

Re: How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

Jeremiah — Wed, 03 Aug 2016 14:52:29 GMT

Search jobs run in their own process on the Splunk server. So the assignment of a core to a search is done by the operating system. Splunk is controlling the number of simultaneous searches that can execute based upon the number of cores in your system. In 6.3+ Splunk can run parallel search and indexing pipelines, so that you can take advantage of more cores in your server.

Take a look at these previous answers and conf slide decks, they should help answer your questions:

https://answers.splunk.com/answers/330733/should-i-turn-on-hyperthreading-with-splunk.html
http://conf.splunk.com/session/2015/conf2015_ANekkanti_SPal_ATameem_Splunk_SplunkClassics_Harnessing63PerformanceAnd_a.pdf
http://conf.splunk.com/session/2015/conf2015_DBitincka_Splunk_Deploying_NotesonOptimizingSplunk.pdf

Re: How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

ddrillic — Tue, 29 Sep 2020 10:31:00 GMT

Please keep in mind that max_searches_per_cpu exists in limits.conf.

Good discussion at Why are the default values of max_searches_per_cpu and base_max_searches in limits.conf lowered in 5.x?