CPU on Indexers

[bobbyoommen]

Hello,

https://docs.splunk.com/Documentation/Splunk/8.0.1/Capacity/Referencehardware

Splunk documentation (High Performance option Spec) says 2GHz or higher CPU speed on indexers.

Wondering have you seen use-cases where increasing the core count is helpful. Also the same case, using faster CPU’s.

Thank you,
Bobby, NetApp Inc.

[woodcock · Accepted solution]

Indexers are almost always DiskIO-bound, then PortIO-bound, then RAM-bound, then CPU-bound. Spend your money in that order. The best bang for you buck is probably ugrading your Ethernet to the fastest Hw/wires possible, then either going to SmartStore or upgrading disk to direct-attached SSD.