Getting Data In

Single Instance Splunk - How is CPU allocation prioritised between searches and indexing?


Quick question as I am struggling to find answers in the Splunk documentation.

How does Splunk prioritise CPU allocation on a single instance deployment, between searching and indexing?

Reason I ask is, we have a heavy forwarder sending data over TCP to our single instance.
However, we are experiencing intermittent drops (maybe once every couple of days, of approx a 5 minute period) in data ingestion.
There are messages relating to the TcpOutputProcessor component, stating the processor has paused data flow and forwarding has therefore been blocked.
We cannot see problems in our network that would cause the disconnect between the forwarder and indexer, but there is concern that with the amount of searches we are executing on our Indexer (we regularly hit the concurrent search limit), that we simply do not have enough CPU to carry out indexing, whilst we keep hitting the concurrent search limit.

Therefore, the question is, how is Indexing effected if loads of searches are being carried out at any one time?
Does searching take precedence over indexing in terms of CPU usage?
I heard somewhere that searching takes an 'n -1' view over Indexing, i.e. if you have 10 CPU, and 10 searches being executed, all but 1 CPU is allocated to Searches, with 1 CPU available for indexing. Is this true? And if so, if this regularly happens, can this impact performance at the Indexing end that would cause a pause in data flow as per the log message we receive?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...