Getting Data In

heavy forwarder multi core?

danan5
Path Finder

Hi,

I see a few similar questions in the past however I can't see an answer to date.

Does anyone know if the splunkd process can utilise modern multicore cpu architectures? or is it bound to a single thread of execution?

The splunk ingest pipeline looks to me (as a non-programmer) as something that might lend itself to multi-threading.

Thanks,
David

0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

If you increase the parallel ingestion pipelines on the forwarder (default = 1), it will utilize one core per pipeline.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipe...

One caveat worth noting, when handling compressed files (.gz) the forwarder will utilize a single pipeline only, regardless of the pipeline setting.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

codebuilder
SplunkTrust
SplunkTrust

If you increase the parallel ingestion pipelines on the forwarder (default = 1), it will utilize one core per pipeline.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Pipelinesets#Forwarders_and_multiple_pipe...

One caveat worth noting, when handling compressed files (.gz) the forwarder will utilize a single pipeline only, regardless of the pipeline setting.

----
An upvote would be appreciated and Accept Solution if it helps!
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...