Deployment Architecture

Is this Sparc system a good choice for my splunk indexer? If not, what is?

Splunk Employee
Splunk Employee

My hardware vendor just called and offered me a great deal on a Sun SPARC Enterprise T5120 Server, he said it would be perfect for something like Splunk, which uses lots of CPU cores.

Is this correct? What kind of server should I be looking at buying in general?

Tags (4)
1 Solution

Splunk Employee
Splunk Employee

Sparc is a low-performance choice for Splunk indexing and search. The reason is that Splunk is CPU intensive as well as I/O intensive (and depending upon search patterns can require a good deal of memory as well). Moreover, typical Splunk tasks for a single request are not very parallelizable, and will be typically bound by single-cpu-core performance. For Splunk workloads, a typical x86-64 modern server-class core will deliver as much as ten times the performance as a modern sparc server-class core.

The Ultrasparc T1 and T2 "Niagara" CPUs, such as the one linked, are particularly ill-suited. These CPUs are designed for high efficiency and high parallelism, but without high performance per thread. This makes them good at loads that are individually light but highly parallel, such as high volume web sites. Essentially they optimized loads where task switching could be a large portion of the cost, or when there is a high penalty for small latencies. Splunk has only moderate parallelism, requires high performance per thread, and does not have the costs or problems this arch optimizes for.

Although Splunk has a web interface, it is not serving static documents like a web server, but performing significant computation and I/O to run searches.


To a lesser degree these same issues will be a concern on Itanium or POWER systems, but there it's more a matter of the price per performance ratios being quite different as opposed to the raw performance.


In general, x86-64 or amd64 CPUs are the recommended architecture / CPU types for Splunk.

As a general guide, take a look at http://docs.splunk.com/Documentation/Splunk/5.0/Installation/CapacityplanningforalargerSplunkdeploym...

Note that Splunk scales well horizontally, so a number of cheaper machines in parallel are often desirable over one larger system with many cores.


Don't forget to take all this advice in context. If you're indexing 100MB a day and have 4 users, performance considerations become much less essential.

View solution in original post

Splunk Employee
Splunk Employee

Sparc is a low-performance choice for Splunk indexing and search. The reason is that Splunk is CPU intensive as well as I/O intensive (and depending upon search patterns can require a good deal of memory as well). Moreover, typical Splunk tasks for a single request are not very parallelizable, and will be typically bound by single-cpu-core performance. For Splunk workloads, a typical x86-64 modern server-class core will deliver as much as ten times the performance as a modern sparc server-class core.

The Ultrasparc T1 and T2 "Niagara" CPUs, such as the one linked, are particularly ill-suited. These CPUs are designed for high efficiency and high parallelism, but without high performance per thread. This makes them good at loads that are individually light but highly parallel, such as high volume web sites. Essentially they optimized loads where task switching could be a large portion of the cost, or when there is a high penalty for small latencies. Splunk has only moderate parallelism, requires high performance per thread, and does not have the costs or problems this arch optimizes for.

Although Splunk has a web interface, it is not serving static documents like a web server, but performing significant computation and I/O to run searches.


To a lesser degree these same issues will be a concern on Itanium or POWER systems, but there it's more a matter of the price per performance ratios being quite different as opposed to the raw performance.


In general, x86-64 or amd64 CPUs are the recommended architecture / CPU types for Splunk.

As a general guide, take a look at http://docs.splunk.com/Documentation/Splunk/5.0/Installation/CapacityplanningforalargerSplunkdeploym...

Note that Splunk scales well horizontally, so a number of cheaper machines in parallel are often desirable over one larger system with many cores.


Don't forget to take all this advice in context. If you're indexing 100MB a day and have 4 users, performance considerations become much less essential.

View solution in original post

Splunk Employee
Splunk Employee

Great info thanks!

0 Karma

Splunk Employee
Splunk Employee

Poor sparc, but good post! 🙂

0 Karma