Archive
Highlighted

What Splunk stats should I look at to determine if my indexers should use additional pipelines?

Champion

Hi,

What Splunk stats should we look at to determine if our indexers are candidate for multiple pipelines? SoS cpu usage?

0 Karma
Highlighted

Re: What Splunk stats should I look at to determine if my indexers should use additional pipelines?

Splunk Employee
Splunk Employee

There are a few different factors here you should consider depending on whether you are talking about search, index, or batch pipelines.

These general rules can generally be applied. What you should be looking at is general CPU, Memory, and Disk I/o on your indexer/HF over a historical period and compare to your system utilization. If you have the system resources available, you can enable this. However, if there is any general concern that you are resource quenched, dont touch this...

SoS is technically usable, but deprecated. You should be looking at DMC.

Docs : http://docs.splunk.com/Documentation/Splunk/6.4.0/Capacity/Parallelization

0 Karma
Highlighted

Re: What Splunk stats should I look at to determine if my indexers should use additional pipelines?

Champion

Thanks. We are at 6.1, so I'm still using SoS, but this matches what I thought, exactly. Can't wait. Thanks!

0 Karma