Splunk Search

Splunk search head CPU cores required for reporting command based search

Mag2sub
Path Finder

How would CPU core load or CPU core sizing be split between a search head and its peer indexer when "searches with reporting commands" are run from the search head and these are feeding into search head dashboards ?

Will the search take away CPU cores of indexer ONLY or would i require 1 cpu core for a reporting search at search head and also 1 core on the specific peer the search is run against?

Confused ..bear with the newbie 🙂

Tags (1)
0 Karma

grijhwani
Motivator

A distributed search functions by the search head requesting that all indexers perform the search on their own content and return the results, then itself aggregating and presenting them as required by the user. In simple terms the search load is handled by the indexer, the presentation by the search head.

0 Karma

Mag2sub
Path Finder

Theoritically i did expect the above answer But would that mean i do NOT have to allocate CPU cores on the search head for the search ?

I dont believe the above addresses the CPU sizing question ...and sometimes the kind of search that is run also perhaps decides whether its peer indexer intensive on search front or search head

Appreciate any inputs with specific reference to CPU core sizing for searches

Thanks !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...