topic Search Head pool on RAMdisk in Deployment Architecture

Search Head pool on RAMdisk

ejpulsar — Mon, 28 Oct 2013 07:59:11 GMT

Hi,
As I know, search head pool needs a tremendous IOPS to operate fast. Last "good to go" configuration i've heard from splunk architect was 10k IOPS per search peer.

If I'll setup 30GB RAMDISK with Linux tmpfs, sharing it over tuned NFS to another head and supplying it with proper rsync scripted "backend", will it sounds good?

Re: Search Head pool on RAMdisk

johnebgood — Thu, 31 Oct 2013 03:14:26 GMT

I'm experimenting with ramdisks myself. You can't use tmpfs as Splunk throws an error but you can increase the possible ramdisk size via kernel options and use mkfs on a /dev/ramX device. In grub just edit your kernel line and append ramdisk_size=X

kernel /vmlinuz-2.6.32.24 ro root=LABEL=/ rhgb quiet ramdisk_size=4000000

This is for a max ramdisk size of 4gb.

Then:
mkfs /dev/ram0 4000000
mkdir /mnt/ramdisk0
mount /dev/ram0 /mnt/ramdisk0

Interested to hear your results with the search head pool, I'm currently testing on an indexer and I am observing what appears to be blazing speed but the verdict is still out on total improvement. Will report back with more.

Re: Search Head pool on RAMdisk

Lucas_K — Tue, 26 Aug 2014 23:30:58 GMT

Bump. Just wondering how this ended up working out?

Re: Search Head pool on RAMdisk

ejpulsar — Wed, 29 Oct 2014 12:26:24 GMT

Hi!

Yes, we've got nearly 100k sustained IOPS on RHEL HA Storage and NFS.
But this configuration is not moved to production, we've decide to stand on SSD's.