Splunk Search

How many CPU cores required for handling concurrent searches

splunker12er
Motivator

no . of search head -1 (8 cores)
no. of indexers - 4 (24-cores each)

So, my system-wide concurrent searches limit is 32.
Since my indexers have 24 cores, it should handle more no. of job-requests. So, is it enough if I alter the limits.conf values to get a max no. to cater more no. of concurrent searches?
OR should I increase more CPU cores in search head also?

I understand that indexer's cores needed for read/write operations which is also accountable under 24 -cores , still many should be ideal ?!

Please advise me.

0 Karma

krishna_shidnek
Engager

16 cores are recommended for search Head

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you have plenty of indexer-heavy searches (retrieving lots of data, basic reporting, etc.) instead of search-head-heavy searches (transactions, etc.) then your search head will be able to support much more than the default limit of concurrent searches - feel free to increase that in limits.conf and monitor your search head's CPU load. The worst that could happen is searches slowing down a bit, but overall throughput should increase compared to queueing them.

In terms of balance, your search head's eight cores should be overwhelmed by 96 indexer cores in total - consider doubling or tripling the core count in your search head to increase overall throughput.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...