Deployment Architecture

distsearch.conf replicationThreads

sfmandmdev
Path Finder

What factors should be taken into consideration in deciding the appropriate number of replicationThreads? Are there any performance considerations for increasing this value?

1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

The default number of replication threads is set to 5 by default. You should take into consideration the number of search peers, the network bandwidth between search head and peers as well as the size of the bundles when changing this value. Consider increasing it if you have a lot of peers, the link between SH and peers is slow and the bundle are large. If you have SSL enabled between SH and peers you will incur a high cpu load during the transfer because the bundle will be encrypted, compressed and sent to the peers by X thread in parallel.

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

The default number of replication threads is set to 5 by default. You should take into consideration the number of search peers, the network bandwidth between search head and peers as well as the size of the bundles when changing this value. Consider increasing it if you have a lot of peers, the link between SH and peers is slow and the bundle are large. If you have SSL enabled between SH and peers you will incur a high cpu load during the transfer because the bundle will be encrypted, compressed and sent to the peers by X thread in parallel.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...