Splunk Search

How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

Path Finder

How does Splunk assign processor cores to execute a job like running script, scheduled search, ad hoc search, etc.

Let's say I have in total 2 sockets x 8 cores = 16 cores,
each core has 2 logical cores, so in total it has 32 logical cores (threads)

My question:
- Does Splunk use the physical core or logical core for any Splunk job?
- How does Splunk assign it to do the job? I mean is it random or round robin thing or how?


Ultra Champion

Please keep in mind that max_searches_per_cpu exists in limits.conf.

Good discussion at Why are the default values of max_searches_per_cpu and base_max_searches in limits.conf lowered in 5...


Search jobs run in their own process on the Splunk server. So the assignment of a core to a search is done by the operating system. Splunk is controlling the number of simultaneous searches that can execute based upon the number of cores in your system. In 6.3+ Splunk can run parallel search and indexing pipelines, so that you can take advantage of more cores in your server.

Take a look at these previous answers and conf slide decks, they should help answer your questions:


0 Karma