Monitoring Splunk

CPU on Indexers

bobbyoommen
Engager

Hello,

https://docs.splunk.com/Documentation/Splunk/8.0.1/Capacity/Referencehardware

Splunk documentation (High Performance option Spec) says 2GHz or higher CPU speed on indexers.

Wondering have you seen use-cases where increasing the core count is helpful. Also the same case, using faster CPU’s.

Thank you,
Bobby, NetApp Inc.

Labels (1)
1 Solution

woodcock
Esteemed Legend

Indexers are almost always DiskIO-bound, then PortIO-bound, then RAM-bound, then CPU-bound. Spend your money in that order. The best bang for you buck is probably ugrading your Ethernet to the fastest Hw/wires possible, then either going to SmartStore or upgrading disk to direct-attached SSD.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Indexers are almost always DiskIO-bound, then PortIO-bound, then RAM-bound, then CPU-bound. Spend your money in that order. The best bang for you buck is probably ugrading your Ethernet to the fastest Hw/wires possible, then either going to SmartStore or upgrading disk to direct-attached SSD.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...