Splunk Search
Highlighted

How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

Path Finder

How does Splunk assign processor cores to execute a job like running script, scheduled search, ad hoc search, etc.

Let's say I have in total 2 sockets x 8 cores = 16 cores,
each core has 2 logical cores, so in total it has 32 logical cores (threads)

My question:
- Does Splunk use the physical core or logical core for any Splunk job?
- How does Splunk assign it to do the job? I mean is it random or round robin thing or how?

Thanks,

Highlighted

Re: How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

Motivator

Search jobs run in their own process on the Splunk server. So the assignment of a core to a search is done by the operating system. Splunk is controlling the number of simultaneous searches that can execute based upon the number of cores in your system. In 6.3+ Splunk can run parallel search and indexing pipelines, so that you can take advantage of more cores in your server.

Take a look at these previous answers and conf slide decks, they should help answer your questions:

https://answers.splunk.com/answers/330733/should-i-turn-on-hyperthreading-with-splunk.html
http://conf.splunk.com/session/2015/conf2015_ANekkanti_SPal_ATameem_Splunk_SplunkClassics_Harnessing...
http://conf.splunk.com/session/2015/conf2015_DBitincka_Splunk_Deploying_NotesonOptimizingSplunk.pdf

0 Karma
Highlighted

Re: How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

Ultra Champion

Please keep in mind that max_searches_per_cpu exists in limits.conf.

Good discussion at Why are the default values of maxsearchespercpu and basemax_searches in limits.conf lowered in 5.x?

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.