Hi all,
I am using Heavy forwarder (splunk version 8.0.1 and os-windows) to ingest .zip log files but I could see very less cores are getting used which is around 2 to 3 .although Heavy forwarder has 8 cores available . So how can I make setting to use all cores by splunk.
Also I have increased parallelingestion pipelines to 2.
So is there any setting by which I can increase cores used by splunk?
Thanks,
Regardless of how many cores or pipelines you have configured, compressed file ingestion only ever uses 1 core.
Other sources will use any additional available pipelines as long as they do not also contain compressed files.
In short, Splunk forwarders can only process one archived file at a time, hence the usage patterns you are seeing
Hi @ips_mandar,
You got the right setting, the number of cores used is equivalent to the value you set in parallelIngestionPipelines
. So if you'd like to use more cores simply increase that value in server.conf
and you're all set.
Let us know if you need more help.
Cheers,
David
check out this answer:
https://answers.splunk.com/answers/803148/heavy-forwarder-multi-core.html#answer-801919