We are currently looking at improving CPU optimization on the Splunk environment. We have found that the limits.conf contain the following option :
multi_threaded_setup = [0|1] Flag indicating whether to use multiple threads when setting up distributed search to multiple peers. Defaults to false (0)
I have done tests in the lab on both the search head and the indexer and I can't see any behavior change looking at the threads number. How should we activate this option and is it worth it?