Forums: SplunkGeneral: Multi-core processors and Splunk

I remember reading that since version 3, Splunk can take advantage of multi-core processors and that 8-core servers are recommended if you're expecting up to 4 concurrent searches.

Is there any point in having an 8-core processor if you're only expecting 1 or 2 searches at any point in time? I notice that the recommended hardware is 2 dual-core 3.4GHz processor with 4GB
RAM.

Most of our standard servers have at least that amount of memory (16 or 32GB) but usually 8-core 2.4GHz processors. Is there any benefit in having 3.4GHz processors? Would you recommend a single server with your recommended specs over 2 servers as I described?

Thanks.

Splunk loves hardware. The stuff that Splunk is doing, all aggregated together, can really nail the average box. Very good hardware is becoming more and more of a commodity, and in my experience, the more you use Splunk, the more hard work you want to make it do. With the proper tuning, you can realize tremendous gains by leveraging gluttonous hardware.

Thus, for the best experience, I always recommend getting the fastest, biggest box you can afford, emphasizing fast and plentiful storage (prefer >4 Gb fiber, 100's of spindles :D), core speed (faster indexing), 64-bit (search time paging), and a lot of memory (bigger bucket size). You can take the wimpier boxes such as blades and forward data with them, or use them for other less "needy" applications.

To answer your questions:

1) yes, if you need to index a lot of data or you love speed
2) of course
3) it depends on your requirements