Getting Data In

Increase use core by splunk

ips_mandar
Builder

Hi all,
I am using Heavy forwarder (splunk version 8.0.1 and os-windows) to ingest .zip log files but I could see very less cores are getting used which is around 2 to 3 .although Heavy forwarder has 8 cores available . So how can I make setting to use all cores by splunk.
Also I have increased parallelingestion pipelines to 2.
So is there any setting by which I can increase cores used by splunk?
Thanks,

0 Karma

nickhills
Ultra Champion

Regardless of how many cores or pipelines you have configured, compressed file ingestion only ever uses 1 core.
Other sources will use any additional available pipelines as long as they do not also contain compressed files.

In short, Splunk forwarders can only process one archived file at a time, hence the usage patterns you are seeing

If my comment helps, please give it a thumbs up!

DavidHourani
Super Champion

Hi @ips_mandar,

You got the right setting, the number of cores used is equivalent to the value you set in parallelIngestionPipelines. So if you'd like to use more cores simply increase that value in server.conf and you're all set.

Let us know if you need more help.

Cheers,
David

adonio
Ultra Champion
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...