How do variations in cpu core speeds of the indexers affect the indexer cluster?

[danielbb]

We just found out that on one site, the four indexers have cores at 2.7GHz speed while on the other site, we have core speeds of 2.20GHz and 2.40GHz.

In the MC's graphs the indexer with the cores of 2.20GHz, seems to be lagging behind in performance.

Can the splunk indexer cluster adjust to different speeds? Meaning, does the cluster master keep track of such variations and adjust? If not, what can we do to improve the load on the indexers?

[esix_splunk]

Currently the indexer tier has no understanding of what compute (clock speed or core counts) are available among other peers in a cluster. This is why the current recommendation is for the indexers to match in clock, core, memory, and disk storage. With that, the CM is only aware of the peers and their bucket primacy. Search jobs are distributed and managed by the scheduler for this, and again nothing is shared among peers for this... yet.

There really isnt much tuning that can be recommended without understanding the existing workloads and platform metrics. You might consider reaching out to Splunk Support and see if there is anything they can recommend based on configs that you can provide in a ticket. 

[danielbb]

Thank you for this clear insight and I really wonder whether Support can assist us.