Splunk Search

How many CPU cores required for handling concurrent searches

splunker12er
Motivator

no . of search head -1 (8 cores)
no. of indexers - 4 (24-cores each)

So, my system-wide concurrent searches limit is 32.
Since my indexers have 24 cores, it should handle more no. of job-requests. So, is it enough if I alter the limits.conf values to get a max no. to cater more no. of concurrent searches?
OR should I increase more CPU cores in search head also?

I understand that indexer's cores needed for read/write operations which is also accountable under 24 -cores , still many should be ideal ?!

Please advise me.

0 Karma

krishna_shidnek
Engager

16 cores are recommended for search Head

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you have plenty of indexer-heavy searches (retrieving lots of data, basic reporting, etc.) instead of search-head-heavy searches (transactions, etc.) then your search head will be able to support much more than the default limit of concurrent searches - feel free to increase that in limits.conf and monitor your search head's CPU load. The worst that could happen is searches slowing down a bit, but overall throughput should increase compared to queueing them.

In terms of balance, your search head's eight cores should be overwhelmed by 96 indexer cores in total - consider doubling or tripling the core count in your search head to increase overall throughput.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...