What Splunk stats should I look at to determine if my indexers should use additional pipelines?

[a212830]

Hi,

What Splunk stats should we look at to determine if our indexers are candidate for multiple pipelines? SoS cpu usage?

[esix_splunk]

There are a few different factors here you should consider depending on whether you are talking about search, index, or batch pipelines.

These general rules can generally be applied. What you should be looking at is general CPU, Memory, and Disk I/o on your indexer/HF over a historical period and compare to your system utilization. If you have the system resources available, you can enable this. However, if there is any general concern that you are resource quenched, dont touch this...

SoS is technically usable, but deprecated. You should be looking at DMC.

Docs : http://docs.splunk.com/Documentation/Splunk/6.4.0/Capacity/Parallelization

[a212830]

Thanks. We are at 6.1, so I'm still using SoS, but this matches what I thought, exactly. Can't wait. Thanks!