Splunk Search

How many CPU cores required for handling concurrent searches

splunker12er
Motivator

no . of search head -1 (8 cores)
no. of indexers - 4 (24-cores each)

So, my system-wide concurrent searches limit is 32.
Since my indexers have 24 cores, it should handle more no. of job-requests. So, is it enough if I alter the limits.conf values to get a max no. to cater more no. of concurrent searches?
OR should I increase more CPU cores in search head also?

I understand that indexer's cores needed for read/write operations which is also accountable under 24 -cores , still many should be ideal ?!

Please advise me.

0 Karma

krishna_shidnek
Engager

16 cores are recommended for search Head

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you have plenty of indexer-heavy searches (retrieving lots of data, basic reporting, etc.) instead of search-head-heavy searches (transactions, etc.) then your search head will be able to support much more than the default limit of concurrent searches - feel free to increase that in limits.conf and monitor your search head's CPU load. The worst that could happen is searches slowing down a bit, but overall throughput should increase compared to queueing them.

In terms of balance, your search head's eight cores should be overwhelmed by 96 indexer cores in total - consider doubling or tripling the core count in your search head to increase overall throughput.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...