Splunk Search

How many CPU cores required for handling concurrent searches

splunker12er
Motivator

no . of search head -1 (8 cores)
no. of indexers - 4 (24-cores each)

So, my system-wide concurrent searches limit is 32.
Since my indexers have 24 cores, it should handle more no. of job-requests. So, is it enough if I alter the limits.conf values to get a max no. to cater more no. of concurrent searches?
OR should I increase more CPU cores in search head also?

I understand that indexer's cores needed for read/write operations which is also accountable under 24 -cores , still many should be ideal ?!

Please advise me.

0 Karma

krishna_shidnek
Engager

16 cores are recommended for search Head

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you have plenty of indexer-heavy searches (retrieving lots of data, basic reporting, etc.) instead of search-head-heavy searches (transactions, etc.) then your search head will be able to support much more than the default limit of concurrent searches - feel free to increase that in limits.conf and monitor your search head's CPU load. The worst that could happen is searches slowing down a bit, but overall throughput should increase compared to queueing them.

In terms of balance, your search head's eight cores should be overwhelmed by 96 indexer cores in total - consider doubling or tripling the core count in your search head to increase overall throughput.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...