Increase use core by splunk

[ips_mandar]

Hi all,
I am using Heavy forwarder (splunk version 8.0.1 and os-windows) to ingest .zip log files but I could see very less cores are getting used which is around 2 to 3 .although Heavy forwarder has 8 cores available . So how can I make setting to use all cores by splunk.
Also I have increased parallelingestion pipelines to 2.
So is there any setting by which I can increase cores used by splunk?
Thanks,

[nickhills]

Regardless of how many cores or pipelines you have configured, compressed file ingestion only ever uses 1 core.
Other sources will use any additional available pipelines as long as they do not also contain compressed files.

In short, Splunk forwarders can only process one archived file at a time, hence the usage patterns you are seeing

[DavidHourani]

Hi @ips_mandar,

You got the right setting, the number of cores used is equivalent to the value you set in parallelIngestionPipelines. So if you'd like to use more cores simply increase that value in server.conf and you're all set.

Let us know if you need more help.

Cheers,
David

[adonio]

check out this answer:
https://answers.splunk.com/answers/803148/heavy-forwarder-multi-core.html#answer-801919