When I do this on my RHEL indexer:
lscpu | egrep 'Thread|Core|Socket|^CPU\('
I get these results:
*
CPU(s): 32
Thread(s) per core: 2
Core(s) per socket: 8
Socket(s): 2
*
Yet in the "Distributed Management Console", I see that my system has 16 CPU's.
Could this be slowing Splunk Processes down or is it just a bug with the "Distributed Management Console"?
I know that the "Thread(s) per core:" means hyper-threading.
Does Splunk not know how to use hyper-threading?
In v6.3 and v6.4, DMC didn't count it for some reason. I do not know why we didn't count hyper-threaded cores.
Splunkd itself identify number of virtual cores including hyper-threaded. splunkd.log shows how many virtual CPU cores in the system, and that number should include hyper-threaded cores.
In v6.5 DMC (Distributed Monitoring Console) should show number of virtual cores. When hyper-threaded, virtual core should be calculated accordingly.
In v6.3 and v6.4, DMC didn't count it for some reason. I do not know why we didn't count hyper-threaded cores.
Splunkd itself identify number of virtual cores including hyper-threaded. splunkd.log shows how many virtual CPU cores in the system, and that number should include hyper-threaded cores.
In v6.5 DMC (Distributed Monitoring Console) should show number of virtual cores. When hyper-threaded, virtual core should be calculated accordingly.
Hyper-threading does not add cores as far as Splunk is concerned. The DMC is correct.