Should I Turn on Hyperthreading with Splunk?

[David]

My Intel processor supports hyperthreading, which should provide more performance. Should I turn on hyperthreading while using Splunk?

[David · Accepted solution]

Yes, definitely! Splunk, like most solutions, enjoys about a 20-30% performance boost when you turn on Hyperthreading. It's important to note, though, that this is not a doubling of performance.

Note that if you run top (or Windows Task Manager, or etc.), it will appear that you have twice as many CPU cores as you actually do. With the default simultaneous search settings, that means if you have a 16 core system and you turn on HT, you will go from running 22 searches (6 + 16) to 38 searches (6 + 16*2). For understanding how that should impact your overall capacity planning, please check the Capacity Planning documentation. As always, you should monitor the performance of your systems and searches using tools like the Distributed Management Console, Search Activity app, etc.

[AGLbwa]

So a follow-up to this would be (especially given cloud vendors moving to tout vCPUs (i.e. hyperthreaded)) are there any other auto-tunables (or autotuned by default) that would cause performance problems because a 32 vCPU VM only has 20 cores worth of performance but reports 32 cores? What about for indexers?

[hsesterhenn_spl]

Just to link the topics...

If you are running Splunk Enterprise in an environment where the difference between physical CPUs and virtual CPUs/threads is visible for SplunkD (e.g. bare metal, AWS, GCP, etc) you will see a higher "virtual" number which will be taken into account by the Splunk-internal engines. 

See limits.conf. 

If you are in a VMware environment and you see physical CPU=virtual CPU, you need to double the vCPU count in your VMware instance settings  to get the same performance because otherwise SplunkD will use less resources. 

https://community.splunk.com/t5/Archive/How-does-Splunk-handle-Hyperthreading-in-a-VMware-environmen...