Should I Turn on Hyperthreading with Splunk?

[David]

My Intel processor supports hyperthreading, which should provide more performance. Should I turn on hyperthreading while using Splunk?

[David · Accepted solution]

Yes, definitely! Splunk, like most solutions, enjoys about a 20-30% performance boost when you turn on Hyperthreading. It's important to note, though, that this is not a doubling of performance.

Note that if you run top (or Windows Task Manager, or etc.), it will appear that you have twice as many CPU cores as you actually do. With the default simultaneous search settings, that means if you have a 16 core system and you turn on HT, you will go from running 22 searches (6 + 16) to 38 searches (6 + 16*2). For understanding how that should impact your overall capacity planning, please check the Capacity Planning documentation. As always, you should monitor the performance of your systems and searches using tools like the Distributed Management Console, Search Activity app, etc.

[AGLbwa]

So a follow-up to this would be (especially given cloud vendors moving to tout vCPUs (i.e. hyperthreaded)) are there any other auto-tunables (or autotuned by default) that would cause performance problems because a 32 vCPU VM only has 20 cores worth of performance but reports 32 cores? What about for indexers?