Quick question as I am struggling to find answers in the Splunk documentation.
How does Splunk prioritise CPU allocation on a single instance deployment, between searching and indexing?
Reason I ask is, we have a heavy forwarder sending data over TCP to our single instance.
However, we are experiencing intermittent drops (maybe once every couple of days, of approx a 5 minute period) in data ingestion.
There are messages relating to the TcpOutputProcessor component, stating the processor has paused data flow and forwarding has therefore been blocked.
We cannot see problems in our network that would cause the disconnect between the forwarder and indexer, but there is concern that with the amount of searches we are executing on our Indexer (we regularly hit the concurrent search limit), that we simply do not have enough CPU to carry out indexing, whilst we keep hitting the concurrent search limit.
Therefore, the question is, how is Indexing effected if loads of searches are being carried out at any one time?
Does searching take precedence over indexing in terms of CPU usage?
I heard somewhere that searching takes an 'n -1' view over Indexing, i.e. if you have 10 CPU, and 10 searches being executed, all but 1 CPU is allocated to Searches, with 1 CPU available for indexing. Is this true? And if so, if this regularly happens, can this impact performance at the Indexing end that would cause a pause in data flow as per the log message we receive?
