Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched

[payl_chdhry]

Hi,

I am trying to understand a bit on how searches impact CPU usage on indexers.

Does one search uses one CPU core by default or does it depend on indexes being searched

Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched.

Note: It is single query, no subqueries.

[scelikok · Accepted solution]

Hi @payl_chdhry,

Splunk search core usage does not depends on the indexes search, always one core as default. It is normal high cpu usage on search over multiple indexes or large time-range because it is working more buckets.

[payl_chdhry]

Thanks @scelikok for your response.

Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size).

We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.

[gjanders]

While it's not exact the introspection logs record cpu usage in alerts for splunk admins https://splunkbase.splunk.com/app/3796/ I have dashboards such as troubleshooting resource usage per user https://github.com/gjanders/SplunkAdmins/blob/master/default/data/ui/views/troubleshooting_resource_...

Which can find cpu information per search