Getting Data In

heavy forwarder multi core?

danan5
Path Finder

Hi,

I see a few similar questions in the past however I can't see an answer to date.

Does anyone know if the splunkd process can utilise modern multicore cpu architectures? or is it bound to a single thread of execution?

The splunk ingest pipeline looks to me (as a non-programmer) as something that might lend itself to multi-threading.

Thanks,
David

0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

If you increase the parallel ingestion pipelines on the forwarder (default = 1), it will utilize one core per pipeline.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipe...

One caveat worth noting, when handling compressed files (.gz) the forwarder will utilize a single pipeline only, regardless of the pipeline setting.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

codebuilder
SplunkTrust
SplunkTrust

If you increase the parallel ingestion pipelines on the forwarder (default = 1), it will utilize one core per pipeline.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipe...

One caveat worth noting, when handling compressed files (.gz) the forwarder will utilize a single pipeline only, regardless of the pipeline setting.

----
An upvote would be appreciated and Accept Solution if it helps!
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...