We have recently switched our Splunk environment over to larger physical servers running 2 - Intel Xeon E5-2695 v3 processors each. These are 14 core processors, so each machine should be showing 28 cores. However, when I query the server info REST endpoint, it only shows 14 cores each. So I'm sure this is causing issues with performance since Splunk sets parameters based on number of cores. Also, our Enterprise Security app is complaining that the search head doesn't meet the minimum required specifications for hardware.
Please advise.
Thanks.
According to Splunk support, this will be fixed in the 6.3.5 release which is not out yet...
If you didnt get this resolved, can you open a ticket with support and let them run it through our diag tools..
Good question 😉