Sparc is a low-performance choice for Splunk indexing and search. The reason
is that Splunk is CPU intensive as well as I/O intensive (and
depending upon search patterns can require a good deal of memory as
well). Moreover, typical Splunk tasks for a single request are not
very parallelizable, and will be typically bound by single-cpu-core
performance. For Splunk workloads, a typical x86-64 modern
server-class core will deliver as much as ten times the performance as
a modern sparc server-class core.
The Ultrasparc T1 and T2 "Niagara" CPUs, such as the one linked, are
particularly ill-suited. These CPUs are designed for high efficiency
and high parallelism, but without high performance per thread. This
makes them good at loads that are individually light but highly
parallel, such as high volume web sites. Essentially they optimized
loads where task switching could be a large portion of the cost, or
when there is a high penalty for small latencies. Splunk has only
moderate parallelism, requires high performance per thread, and does
not have the costs or problems this arch optimizes for.
Although Splunk has a web interface, it is not serving static
documents like a web server, but performing significant computation
and I/O to run searches.
To a lesser degree these same issues will be a concern on Itanium or
POWER systems, but there it's more a matter of the price per
performance ratios being quite different as opposed to the raw
performance.
In general, x86-64 or amd64 CPUs are the recommended architecture /
CPU types for Splunk.
As a general guide, take a look at
http://docs.splunk.com/Documentation/Splunk/5.0/Installation/CapacityplanningforalargerSplunkdeploym...
Note that Splunk scales well horizontally, so a number of cheaper
machines in parallel are often desirable over one larger system with
many cores.
Don't forget to take all this advice in context. If you're indexing
100MB a day and have 4 users, performance considerations become much
less essential.
