Multi-CPU servers
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Multi-CPU servers
Additional CPUs allow for an increased number of indexing threads which improves Splunk's indexing and search performance.
Important: This value should not be increased unless you have evidence of a specific bottleneck in the indexing processor. Tuning this value incorrectly can have a negative effect on your indexing performance. For extremely busy indexes (>100 GB per day), the maximum value we have seen a benefit from is 3.
Caution: Only increase this value if Splunk is running on a multi-processor, multi-core platform.
indexes.conf
Set the number of indexing threads by adding/editing this attribute in indexes.conf.
indexThreads = <non-negative number> (default=0) | The number of extra threads to use for indexing for this index. This number should not be set higher than the number of processors in the box. If splunkd is also doing parsing and aggregation the number should be 2 less than the number of processors in the box.
|
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.