Splunk Enterprise

Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched

payl_chdhry
Explorer

Hi,

I am trying to understand a bit on how searches impact CPU usage on indexers.

Does one search uses one CPU core by default or does it depend on indexes being searched

Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched.

Note: It is single query, no subqueries.

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @payl_chdhry,

Splunk search core usage does not depends on the indexes search, always one core as default. It is normal high cpu usage on search over multiple indexes or large time-range because it is working more buckets.

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @payl_chdhry,

Splunk search core usage does not depends on the indexes search, always one core as default. It is normal high cpu usage on search over multiple indexes or large time-range because it is working more buckets.

If this reply helps you an upvote is appreciated.
0 Karma

payl_chdhry
Explorer

Thanks @scelikok for your response.

Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size).

We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.

0 Karma

gjanders
SplunkTrust
SplunkTrust

While it's not exact the introspection logs record cpu usage in alerts for splunk admins https://splunkbase.splunk.com/app/3796/ I have dashboards such as troubleshooting resource usage per user https://github.com/gjanders/SplunkAdmins/blob/master/default/data/ui/views/troubleshooting_resource_...

 

Which can find cpu information per search 

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...