Monitoring Splunk

Should I Turn on Hyperthreading with Splunk?

Splunk Employee
Splunk Employee

My Intel processor supports hyperthreading, which should provide more performance. Should I turn on hyperthreading while using Splunk?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Yes, definitely! Splunk, like most solutions, enjoys about a 20-30% performance boost when you turn on Hyperthreading. It's important to note, though, that this is not a doubling of performance.

Note that if you run top (or Windows Task Manager, or etc.), it will appear that you have twice as many CPU cores as you actually do. With the default simultaneous search settings, that means if you have a 16 core system and you turn on HT, you will go from running 22 searches (6 + 16) to 38 searches (6 + 16*2). For understanding how that should impact your overall capacity planning, please check the Capacity Planning documentation. As always, you should monitor the performance of your systems and searches using tools like the Distributed Management Console, Search Activity app, etc.

View solution in original post

Splunk Employee
Splunk Employee

Yes, definitely! Splunk, like most solutions, enjoys about a 20-30% performance boost when you turn on Hyperthreading. It's important to note, though, that this is not a doubling of performance.

Note that if you run top (or Windows Task Manager, or etc.), it will appear that you have twice as many CPU cores as you actually do. With the default simultaneous search settings, that means if you have a 16 core system and you turn on HT, you will go from running 22 searches (6 + 16) to 38 searches (6 + 16*2). For understanding how that should impact your overall capacity planning, please check the Capacity Planning documentation. As always, you should monitor the performance of your systems and searches using tools like the Distributed Management Console, Search Activity app, etc.

View solution in original post

Path Finder

So a follow-up to this would be (especially given cloud vendors moving to tout vCPUs (i.e. hyperthreaded)) are there any other auto-tunables (or autotuned by default) that would cause performance problems because a 32 vCPU VM only has 20 cores worth of performance but reports 32 cores? What about for indexers?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!