Getting Data In

How to see the right number of CPUs for my indexer in the Distributed Management Console?

hartfoml
Motivator

When I do this on my RHEL indexer:

lscpu | egrep 'Thread|Core|Socket|^CPU\('

I get these results:

*
CPU(s): 32
Thread(s) per core: 2
Core(s) per socket: 8
Socket(s): 2
*

Yet in the "Distributed Management Console", I see that my system has 16 CPU's.

Could this be slowing Splunk Processes down or is it just a bug with the "Distributed Management Console"?
I know that the "Thread(s) per core:" means hyper-threading.
Does Splunk not know how to use hyper-threading?

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

In v6.3 and v6.4, DMC didn't count it for some reason. I do not know why we didn't count hyper-threaded cores.
Splunkd itself identify number of virtual cores including hyper-threaded. splunkd.log shows how many virtual CPU cores in the system, and that number should include hyper-threaded cores.

In v6.5 DMC (Distributed Monitoring Console) should show number of virtual cores. When hyper-threaded, virtual core should be calculated accordingly.

View solution in original post

Masa
Splunk Employee
Splunk Employee

In v6.3 and v6.4, DMC didn't count it for some reason. I do not know why we didn't count hyper-threaded cores.
Splunkd itself identify number of virtual cores including hyper-threaded. splunkd.log shows how many virtual CPU cores in the system, and that number should include hyper-threaded cores.

In v6.5 DMC (Distributed Monitoring Console) should show number of virtual cores. When hyper-threaded, virtual core should be calculated accordingly.

richgalloway
SplunkTrust
SplunkTrust

Hyper-threading does not add cores as far as Splunk is concerned. The DMC is correct.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...