Splunk Search

How does Splunk assign processor cores to execute a job (running a scrips, scheduled search, ad hoc search, etc)?

deodion
Path Finder

How does Splunk assign processor cores to execute a job like running script, scheduled search, ad hoc search, etc.

Let's say I have in total 2 sockets x 8 cores = 16 cores,
each core has 2 logical cores, so in total it has 32 logical cores (threads)

My question:
- Does Splunk use the physical core or logical core for any Splunk job?
- How does Splunk assign it to do the job? I mean is it random or round robin thing or how?

Thanks,

ddrillic
Ultra Champion

Please keep in mind that max_searches_per_cpu exists in limits.conf.

Good discussion at Why are the default values of max_searches_per_cpu and base_max_searches in limits.conf lowered in 5...

Jeremiah
Motivator

Search jobs run in their own process on the Splunk server. So the assignment of a core to a search is done by the operating system. Splunk is controlling the number of simultaneous searches that can execute based upon the number of cores in your system. In 6.3+ Splunk can run parallel search and indexing pipelines, so that you can take advantage of more cores in your server.

Take a look at these previous answers and conf slide decks, they should help answer your questions:

https://answers.splunk.com/answers/330733/should-i-turn-on-hyperthreading-with-splunk.html
http://conf.splunk.com/session/2015/conf2015_ANekkanti_SPal_ATameem_Splunk_SplunkClassics_Harnessing...
http://conf.splunk.com/session/2015/conf2015_DBitincka_Splunk_Deploying_NotesonOptimizingSplunk.pdf

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...