topic Smartstore hotlist_recency_secs in Splunk Enterprise

Smartstore hotlist_recency_secs

coreyCLI — Mon, 03 Nov 2025 15:37:28 GMT

I have an index with the hotlist_recency_secs set to 90 days (7776000 seconds). In testing I ran searches for the past 30 days. I noticed in the "Smartstore Cache Performance" dashboard that this 30 days search is triggering "misses". Meaning that this 30 days search is downloading buckets from S3. Why would a 30 days search on an index with hotlist_recency_secs set to 90 days need to download buckets for only a 30 day timeframe? I assume either I have something misconfigured, or more likely, I am not fully understanding the eviction process? the cachemanager, homePath setting, has 15tb per indexer so I don't believe its running out of space.

Re: Smartstore hotlist_recency_secs

richgalloway — Mon, 03 Nov 2025 21:54:10 GMT

The hotlist_recency_secs setting does not prevent a bucket from being evicted from the cache. The goal is to keep the bucket in the cache for (at least) that long, but other demands on the cache may force an early eviction.

We can't tell is 15TB is enough cache space without knowing the ingestion rate. For example, at 1TB/day, it would only hold 15 days of data.

Re: Smartstore hotlist_recency_secs

coreyCLI — Mon, 10 Nov 2025 13:26:25 GMT

Tracking. I have 6 clustered indexers and roughly 300gb per day (right now) of ingest.

Re: Smartstore hotlist_recency_secs

richgalloway — Mon, 10 Nov 2025 15:28:16 GMT

15TB should be enough at 300GB/day. Double-check the max_cache_size, min_free_space, and eviction_padding settings to ensure the entire space is available.

Re: Smartstore hotlist_recency_secs

coreyCLI — Mon, 10 Nov 2025 16:21:00 GMT

Settings are defaults:

max_cache_size = 0

minFreeSpace = 5000

eviction_padding = 5120

So, if I am reading and understanding this correctly. Cachemanager will use the entire 15tb use for homePath and only start evicting buckets using the sum of minFreeSpace + eviction_padding = 10120 MB (roughly 10gb of free space left)?

Re: Smartstore hotlist_recency_secs

richgalloway — Mon, 10 Nov 2025 18:00:01 GMT

You're correct. Those setting say to use all but 10GB of the 15TB so you should have plenty of storage.