Looking through their site it looks like a Splunk search (or a query) can include a large set of non-trivial, CPU intensive operations. Therefore, perhaps, it is a process that does not lending itself well to multithreading: http://splunk-base.splunk.com/answers/12027/singlemulti-thre...