When Splunk executes a search, all runtime search processing happens in the Splunk searching layer component known as a search head. When a Splunk search runs, it executes on a single CPU processor core by the search head, which then works with the various indexing resources to capture, summarize, and present the results. Therefore, the number of cores must be able to handle the amount of concurrent searching you users will require, which includes scheduled searches, ad hoc use, alerts, and so on. It is important to monitor these channels of search activity as usage of the Splunk environment increases. Consuming all search resources will deteriorate the user's experience. Monitoring growing demand and staying ahead of full capacity will be important.