How does Splunk assign processor cores to execute a job like running script, scheduled search, ad hoc search, etc.
Let's say I have in total 2 sockets x 8 cores = 16 cores,
each core has 2 logical cores, so in total it has 32 logical cores (threads)
- Does Splunk use the physical core or logical core for any Splunk job?
- How does Splunk assign it to do the job? I mean is it random or round robin thing or how?
Search jobs run in their own process on the Splunk server. So the assignment of a core to a search is done by the operating system. Splunk is controlling the number of simultaneous searches that can execute based upon the number of cores in your system. In 6.3+ Splunk can run parallel search and indexing pipelines, so that you can take advantage of more cores in your server.
Take a look at these previous answers and conf slide decks, they should help answer your questions: