<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: SmartStore Eviction Failure in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/SmartStore-Eviction-Failure/m-p/696087#M10237</link>
    <description>&lt;P&gt;A warm bucket will not be evicted if it is too new on the premise that new data is more likely to be searched than old data.&amp;nbsp; "new" is defined by &lt;FONT face="courier new,courier"&gt;hotlist_recency_secs&amp;nbsp;&lt;/FONT&gt; and &lt;FONT face="courier new,courier"&gt;hotlist_bloom_filter_recency_hours&amp;nbsp;&lt;/FONT&gt; in indexes.conf.&lt;/P&gt;&lt;P&gt;Urgent mode eviction comes into play when there are not enough files eligible for normal eviction.&amp;nbsp; In urgent mode, the &lt;FONT face="courier new,courier"&gt;hotlist_recency_secs&lt;/FONT&gt; and &lt;FONT face="courier new,courier"&gt;hotlist_bloom_filter_recency_hours&lt;/FONT&gt; settings are ignored.&lt;/P&gt;</description>
    <pubDate>Tue, 13 Aug 2024 03:26:20 GMT</pubDate>
    <dc:creator>richgalloway</dc:creator>
    <dc:date>2024-08-13T03:26:20Z</dc:date>
    <item>
      <title>SmartStore Eviction Failure</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/SmartStore-Eviction-Failure/m-p/695909#M10230</link>
      <description>&lt;P&gt;Hello,&lt;BR /&gt;&lt;BR /&gt;I am experiencing a periodic issue with smartstore where a bucket will try to be evicted then proceeds to fail and does that cycle thousands of times. The indexer IO is fine, the bucket is warm, we have enough cache sizing, and I have not been able to correlate any cache logs with when these failures begin on multiple indexer nodes in the cluster (~33% of indexers).&lt;BR /&gt;&lt;BR /&gt;2 questions:&lt;BR /&gt;* What is an urgent mode eviction?&lt;BR /&gt;* What can cause warm buckets to be unable to be evicted when they rolled to warm ~a full day earlier?&lt;/P&gt;</description>
      <pubDate>Sun, 11 Aug 2024 08:10:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/SmartStore-Eviction-Failure/m-p/695909#M10230</guid>
      <dc:creator>dersonje2</dc:creator>
      <dc:date>2024-08-11T08:10:38Z</dc:date>
    </item>
    <item>
      <title>Re: SmartStore Eviction Failure</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/SmartStore-Eviction-Failure/m-p/696087#M10237</link>
      <description>&lt;P&gt;A warm bucket will not be evicted if it is too new on the premise that new data is more likely to be searched than old data.&amp;nbsp; "new" is defined by &lt;FONT face="courier new,courier"&gt;hotlist_recency_secs&amp;nbsp;&lt;/FONT&gt; and &lt;FONT face="courier new,courier"&gt;hotlist_bloom_filter_recency_hours&amp;nbsp;&lt;/FONT&gt; in indexes.conf.&lt;/P&gt;&lt;P&gt;Urgent mode eviction comes into play when there are not enough files eligible for normal eviction.&amp;nbsp; In urgent mode, the &lt;FONT face="courier new,courier"&gt;hotlist_recency_secs&lt;/FONT&gt; and &lt;FONT face="courier new,courier"&gt;hotlist_bloom_filter_recency_hours&lt;/FONT&gt; settings are ignored.&lt;/P&gt;</description>
      <pubDate>Tue, 13 Aug 2024 03:26:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/SmartStore-Eviction-Failure/m-p/696087#M10237</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2024-08-13T03:26:20Z</dc:date>
    </item>
  </channel>
</rss>

