topic Does Splunk in-memory technology work? in Splunk Enterprise

Does Splunk in-memory technology work?

thkwon — Thu, 14 Apr 2022 16:17:45 GMT

Hello

Does Splunk in-memory technology work?

Big data systems are using in-memory technology across Splunk platforms (data collection/transmission, storage, retrieval, etc.)
I wonder if in-memory technology is applied.

If you have in-memory technology, is Splunk self-developed? Or I wonder if open-source was used.

If you have any data to refer to, please share it with us.

Re: Splunk in-memory processing

PickleRick — Thu, 14 Apr 2022 08:04:56 GMT

It would be nice to know what is the objective of your question and what exactly do you mean by it.

Because the question contains a bunch of marketing buzzwords with no real world applicability, to be honest.

Everything can be "in-memory" as long as you have enough memory.

Re: Splunk in-memory processing

thkwon — Thu, 14 Apr 2022 09:23:18 GMT

In-memory technology refers to a technology that stores data in RAM rather than disk. Because processing speed is up to 10,000 times faster than disk storage methods, it is developed as a data storage, processing, and analysis solution centered on database (db) companies such as SAP and Oracle.

Is the same in-memory technology applied to Splunk?

Does Splunk's Queue (parsing Queue, index Queue...) processing also correspond to in-memory?

Re: Splunk in-memory processing

PickleRick — Thu, 14 Apr 2022 10:05:35 GMT

Sorry, but again you're repeating marketing buzzwords. If you have enough RAM, everything can be memory-based. On the other hand - if you don't have enough RAM, even your "in-memory processing" will be swapped out to disk.

In general, Splunk of course tries to do as much as it can or as it is configured to do in memory.