indexThreads is set to auto how many threads does that mean?

[DrewO]

How can I tell how many threads have been allocated using the auto tune setting of indexThreads?

--snip from indexs.conf.spec --

indexThreads = <number or "auto">
* Specifying "auto" or an invalid value will cause Splunk to autotune this param based on your system
* The number of threads to use for indexing
* The number has to be at least 1 and at most 16
* If specified as < 0 or more than 16, it will be autotuned
* This number should not be set higher than the number of processors in the box.
* If splunkd is also doing parsing and aggregation, the number should be lower than the total number of processors minus two.
* Please only set this value if you are an expert user or are advised by Splunk Support
* CARELESSNESS IN SETTING THIS MAY LEAD TO PERMANENT BRAIN DAMAGE OR LOSS OF JOB

[mkelderm]

This is my qeuery 4.3.4:

index="_internal" source=*splunkd.log indexProcessor AND indexThreads AND param AND autotuned

marc

[zscgeek]

Splunkd.log will tell you what the auto selected value is:

Do a splunk search for "index="_internal" indexThreads param autotuned"

you will get back a result that looks like this:

splunkd.log.1:07-27-2010 21:51:49.747 INFO  IndexProcessor - indexes.conf - indexThreads param autotuned to 2

AS for the laser equipped rhino the best I can do right now is this:

[DrewO]

Ha! I tried that answer . . . they wanted MORE!

[gkanapathy]

I want a pet rhinoceros with laser eye-beams and a razor-sharpened steel horn.

[gkanapathy]

I guess:

• You can't.
• Why would you need to know?

Leave it on auto and forget about it.