- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I want to know about CPU occupation when doing a real-time search.
If I build Splunk in a standalone way, and I configure a real-time search, I think that one of cpu core will be occupied.
But which server's cpu core is occupied by real-time search when configuring distributed search like indexer clustering?
will only cpu core of the search head be occupied? Or, because it is a distributed search, will cpu core of each search peer also be occupied?
Also, if I configured search head clustering, will cpu core of all members be occupied?
I am planning to create large scale configuration for personal use, and planning configure alerts using real time search (rolling window) in the environment, so I want to know how to use cpu core.
I appreciate if someone tell me about it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


In a distributed real-time search, one core for each peer is occupied, but only one core on one search head is used.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


In a distributed real-time search, one core for each peer is occupied, but only one core on one search head is used.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you for answer.
you mean that only one core on one search head is used if search is processed in search head clustering?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Yes, that is what I meant.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you for answer!
I understood it!
