Splunk Search
Highlighted

How many CPU cores required for handling concurrent searches

Motivator

no . of search head -1 (8 cores)
no. of indexers - 4 (24-cores each)

So, my system-wide concurrent searches limit is 32.
Since my indexers have 24 cores, it should handle more no. of job-requests. So, is it enough if I alter the limits.conf values to get a max no. to cater more no. of concurrent searches?
OR should I increase more CPU cores in search head also?

I understand that indexer's cores needed for read/write operations which is also accountable under 24 -cores , still many should be ideal ?!

Please advise me.

0 Karma
Highlighted

Re: How many CPU cores required for handling concurrent searches

SplunkTrust
SplunkTrust

If you have plenty of indexer-heavy searches (retrieving lots of data, basic reporting, etc.) instead of search-head-heavy searches (transactions, etc.) then your search head will be able to support much more than the default limit of concurrent searches - feel free to increase that in limits.conf and monitor your search head's CPU load. The worst that could happen is searches slowing down a bit, but overall throughput should increase compared to queueing them.

In terms of balance, your search head's eight cores should be overwhelmed by 96 indexer cores in total - consider doubling or tripling the core count in your search head to increase overall throughput.

0 Karma
Highlighted

Re: How many CPU cores required for handling concurrent searches

16 cores are recommended for search Head

0 Karma