Monitoring Splunk

Are ad-hoc Splunk searches multi threaded?

ppuru
Path Finder

In simple words, if I execute an ad-hoc search on a Splunk environment that has multiple CPU cores across indexer clusters and search peers, will my search use a single core or will it use more that that? Is there a .conf file that can define this?

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

By default, each search will use a single CPU core. Luckily this is configurable and you can tell Splunk how many searches to dedicate per CPU core. Assuming your running on bare metal, you can hyperthread your CPU to get more out of it. This singe search per core limitation may get in the way when scaling because you may want to accelerate data models which use 3 concurrent CPU cores to rebuild the summary range every 5 minutes.

Before adding more CPU to your search heads, you should add indexers as this will increase search speeds and "lock" CPU for less time when searching (i.e. faster search speeds leads to less utilized CPU cores). You also have the option of adding faster storage to existing indexers which will greatly increase IOPS, thus increasing search speed and using less CPU.

https://conf.splunk.com/files/2016/slides/jiffy-lube-quick-tune-up-for-your-splunk-environment.pdf

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

By default, each search will use a single CPU core. Luckily this is configurable and you can tell Splunk how many searches to dedicate per CPU core. Assuming your running on bare metal, you can hyperthread your CPU to get more out of it. This singe search per core limitation may get in the way when scaling because you may want to accelerate data models which use 3 concurrent CPU cores to rebuild the summary range every 5 minutes.

Before adding more CPU to your search heads, you should add indexers as this will increase search speeds and "lock" CPU for less time when searching (i.e. faster search speeds leads to less utilized CPU cores). You also have the option of adding faster storage to existing indexers which will greatly increase IOPS, thus increasing search speed and using less CPU.

https://conf.splunk.com/files/2016/slides/jiffy-lube-quick-tune-up-for-your-splunk-environment.pdf

richgalloway
SplunkTrust
SplunkTrust

Every search, whether ad-hoc or scheduled, uses a single core on the originating search head and one on each indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...