topic Re: How to evict buckets from smartstore cache? in Deployment Architecture

How to evict buckets from smartstore cache?

szymonledzinski — Wed, 19 Dec 2018 11:17:17 GMT

I'm testing Smartstore feature and I would like to test search performance when all buckets have to be downloaded from remote storage. To do this I would like to evict all the buckets from cache. Is there any command for this?

Re: How to evict buckets from smartstore cache?

dxu_splunk — Sat, 22 Dec 2018 07:50:57 GMT

curl -ku admin:changeme "https://localhost:8089/services/admin/cacheman/_evict" -d path=/path_to_cache/ -d mb=99999999999

you didn't ask for it, but the reverse is:

curl -ku admin:changeme "https://localhost:8089/services/admin/cacheman/_localize" -X POST
NOTE - triggering this endpoint will prevent normal evictions from occurring on the indexer afterwards until it restarts - thanks @tonguyen

Re: How to evict buckets from smartstore cache?

tonguyen_splunk — Sat, 22 Dec 2018 07:55:47 GMT

Note: If you hit the _localize endpoint, you will not be able to evict any additional buckets until a restart occurs.

Re: How to evict buckets from smartstore cache?

gjanders — Sun, 23 Dec 2018 22:36:43 GMT

@dxu excellent answer as always, do you know when cacheman will be added to the REST API reference manual? I cannot see it documented there...

Re: How to evict buckets from smartstore cache?

dxu_splunk — Mon, 14 Jan 2019 21:31:02 GMT

good call, we should doc it! i'll leave some feedback on the REST docs page (bottom of the page!)

Re: How to evict buckets from smartstore cache?

dxu_splunk — Mon, 14 Jan 2019 23:12:11 GMT

there are some notes here https://docs.splunk.com/Documentation/Splunk/latest/Indexer/TroubleshootSmartStore#Troubleshoot_with_REST_searches , not sure when these endpoints will be documented on the REST api

Re: How to evict buckets from smartstore cache?

anz_leycurav — Wed, 30 Sep 2020 00:19:40 GMT

in real life, what does "/path_to_cache/" correspond to? is it the root of an index folder (ie the one containing "db" and "summary") or per bucket?

Thanks Vincent.

Re: How to evict buckets from smartstore cache?

saravanan90 — Mon, 09 Sep 2019 18:04:00 GMT

Incase you want to delete a particular bucket and check how long it takes to download. Use the below.

curl -ku admin:changeme https://XX.XX.XX.XX:8089/services/admin/cacheman/$$bucketid$$/evict -X POST

To get the bucket id(| dbinspect index=indexname). This query result will shows the original path of the data present in splunk. Check the before and after evicting the buckets. Once it is evicted, run search which includes the search results available in the bucket. The buckets will be downloaded in the original path. Index=indexname component=cachemanager action=download bucketid shows it is downloaded.

Re: How to evict buckets from smartstore cache?

krishnasrinivas — Mon, 30 Sep 2019 20:26:56 GMT

Did you find out the answer for this?

Re: How to evict buckets from smartstore cache?

Bselberg — Fri, 21 Feb 2020 19:55:38 GMT

It's the volume name where the cache/hot buckets is located.

so if you have volume
/path/hotIndexVolume
/path/coldMountVolume/

Pass it /path/hotIndexVolume

Re: How to evict buckets from smartstore cache?

splunker686 — Sun, 04 Jun 2023 23:23:24 GMT

For the manual localize endpoint mentioned:

curl -ku admin:changeme "https://localhost:8089/services/admin/cacheman/_localize" -X POST

Will it be localizing of all the buckets, of all the smartstore enabled indexes? What are the specific endpoints for localizing an individual bucket or index?