We have 5 16-core 2.67 GHz/48GB RAM and 3 8-core 2.39 GHz/32GB RAM Physicals. 2 of the 16 core boxes are search heads, the other 3 are indexers. 2 of the 8 core boxes are search heads (1 Job Server for summary indexing, 1 Job Server for real-time alerting), the other is an indexer.
I have noticed that none of the 16 core boxes use over 8GB RAM or 30% CPU. I have been reading several posts about an "unsupported" methodology for installing 2 instances of Splunk on a single host when that host has more than 8 cores. I have done this in our QA environment and seen no evidence of negative performance impact or conflicting configs, even with them both running separate tasks concurrently.
My question... I know I can do this on the 16-core indexers, no problem. I would like to do the same thing on the search heads because the application hardware utilization with 2 instances seems to be much better, using about 60-70% CPU/14-20GB RAM during peak. The snag seems to be that only 1 instance of Splunk Web can run at a time, even when I change the service names and port for the GUI.
Has anyone else tried this or know of a way to get around this limitation?
