How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

[deodion]

How does Splunk assign processor cores to execute a job like running script, scheduled search, ad hoc search, etc.

Let's say I have in total 2 sockets x 8 cores = 16 cores,
each core has 2 logical cores, so in total it has 32 logical cores (threads)

My question:
- Does Splunk use the physical core or logical core for any Splunk job?
- How does Splunk assign it to do the job? I mean is it random or round robin thing or how?

Thanks,

[ddrillic]

Please keep in mind that max_searches_per_cpu exists in limits.conf.

Good discussion at Why are the default values of max_searches_per_cpu and base_max_searches in limits.conf lowered in 5...

[Jeremiah]

Search jobs run in their own process on the Splunk server. So the assignment of a core to a search is done by the operating system. Splunk is controlling the number of simultaneous searches that can execute based upon the number of cores in your system. In 6.3+ Splunk can run parallel search and indexing pipelines, so that you can take advantage of more cores in your server.

Take a look at these previous answers and conf slide decks, they should help answer your questions:

https://answers.splunk.com/answers/330733/should-i-turn-on-hyperthreading-with-splunk.html
http://conf.splunk.com/session/2015/conf2015_ANekkanti_SPal_ATameem_Splunk_SplunkClassics_Harnessing...
http://conf.splunk.com/session/2015/conf2015_DBitincka_Splunk_Deploying_NotesonOptimizingSplunk.pdf