Hi,
I am trying to understand a bit on how searches impact CPU usage on indexers.
Does one search uses one CPU core by default or does it depend on indexes being searched
Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched.
Note: It is single query, no subqueries.
Hi @payl_chdhry,
Splunk search core usage does not depends on the indexes search, always one core as default. It is normal high cpu usage on search over multiple indexes or large time-range because it is working more buckets.
Hi @payl_chdhry,
Splunk search core usage does not depends on the indexes search, always one core as default. It is normal high cpu usage on search over multiple indexes or large time-range because it is working more buckets.
Thanks @scelikok for your response.
Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size).
We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.
While it's not exact the introspection logs record cpu usage in alerts for splunk admins https://splunkbase.splunk.com/app/3796/ I have dashboards such as troubleshooting resource usage per user https://github.com/gjanders/SplunkAdmins/blob/master/default/data/ui/views/troubleshooting_resource_...
Which can find cpu information per search