Single/Multi Threading CPU

[LCM]

Is splunk itself single or multi threading capable in a CPU architecture perspective?

The docus I've read was mostly about x86 arch. but not SPARC!

Example:

If splunk is multithreaded and I'm installing it on a T-series server (Sun) I might be faster than on a M-series server (Sun), cos T-series has more threads per core. On the other hand, if it's singlethreaded, I'm better on the M-series (less threads, but more power per thread), but that one is much more expensive.

I know, who will install it these days on SPARC - sometimes politics wins!

I read through some documentation, and I might have a guess: Single Threaded!

[David · Accepted solution]

Take a look at this Splunk Answers:

http://answers.splunk.com/questions/1829/splunk-searches-to-be-multithreaded-in-a-single-box

The short answer is that Splunk as a system is multi-threaded, but there are some Splunk processes that are not. Notably: indexing is multi-threaded, searches aren't. As gkanapathy mentions below, each search will use a single process and thread, so if you have 12 simultaneous searches, and a high indexing load, Splunk itself could use 16 threads.

Perhaps an engineer can provide guidance if there is anything particular to SPARC systems, but I believe that link is representative.

[David]

Thanks for the corrections. I fixed the errors in my original answer, should anyone read it in the future and skip over comments.

[gkanapathy]

All that said, please do not analogize Splunk with a web server for the purposes of sizing and multithreading. It is much more analogous to a database server, in that CPU and threads are only a small part of the performance factors, and rarely the most important ones.

[gkanapathy]

Furthermore, each concurrent search uses a full process and thread.

[gkanapathy]

That is incorrect. The indexing process is multi-threaded, up to four or more threads, though in practice you'll usually see two.

[LCM]

In the thread you posted, silvermails answer explains it best (for me). While searching, one core is beeing clamed and the rest ist idling (single-thread) - Thanks David for the hint!