Splunk search head CPU cores required for reporting command based search

[Mag2sub]

How would CPU core load or CPU core sizing be split between a search head and its peer indexer when "searches with reporting commands" are run from the search head and these are feeding into search head dashboards ?

Will the search take away CPU cores of indexer ONLY or would i require 1 cpu core for a reporting search at search head and also 1 core on the specific peer the search is run against?

Confused ..bear with the newbie 🙂

[grijhwani]

A distributed search functions by the search head requesting that all indexers perform the search on their own content and return the results, then itself aggregating and presenting them as required by the user. In simple terms the search load is handled by the indexer, the presentation by the search head.

[Mag2sub]

Theoritically i did expect the above answer But would that mean i do NOT have to allocate CPU cores on the search head for the search ?

I dont believe the above addresses the CPU sizing question ...and sometimes the kind of search that is run also perhaps decides whether its peer indexer intensive on search front or search head

Appreciate any inputs with specific reference to CPU core sizing for searches

Thanks !