Getting Data In
Highlighted

Increase use core by splunk

Contributor

Hi all,
I am using Heavy forwarder (splunk version 8.0.1 and os-windows) to ingest .zip log files but I could see very less cores are getting used which is around 2 to 3 .although Heavy forwarder has 8 cores available . So how can I make setting to use all cores by splunk.
Also I have increased parallelingestion pipelines to 2.
So is there any setting by which I can increase cores used by splunk?
Thanks,

0 Karma
Highlighted

Re: Increase use core by splunk

SplunkTrust
SplunkTrust
Highlighted

Re: Increase use core by splunk

SplunkTrust
SplunkTrust

Hi @ips_mandar,

You got the right setting, the number of cores used is equivalent to the value you set in parallelIngestionPipelines. So if you'd like to use more cores simply increase that value in server.conf and you're all set.

Let us know if you need more help.

Cheers,
David

Highlighted

Re: Increase use core by splunk

Ultra Champion

Regardless of how many cores or pipelines you have configured, compressed file ingestion only ever uses 1 core.
Other sources will use any additional available pipelines as long as they do not also contain compressed files.

In short, Splunk forwarders can only process one archived file at a time, hence the usage patterns you are seeing