By default, each search will use a single CPU core. Luckily this is configurable and you can tell Splunk how many searches to dedicate per CPU core. Assuming your running on bare metal, you can hyperthread your CPU to get more out of it. This singe search per core limitation may get in the way when scaling because you may want to accelerate data models which use 3 concurrent CPU cores to rebuild the summary range every 5 minutes.
Before adding more CPU to your search heads, you should add indexers as this will increase search speeds and "lock" CPU for less time when searching (i.e. faster search speeds leads to less utilized CPU cores). You also have the option of adding faster storage to existing indexers which will greatly increase IOPS, thus increasing search speed and using less CPU.
https://conf.splunk.com/files/2016/slides/jiffy-lube-quick-tune-up-for-your-splunk-environment.pdf
... View more