topic Settings to improve Splunk performance on high-spec boxes? in Monitoring Splunk https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99223#M1196 <P>Are there any settings that can be set to help Splunk make better use of a high-end box? (I'm currently working with 16x2.4G core, 64GB RAM box.) I was asked if we can "push more things to memory."</P> Tue, 10 May 2011 21:52:34 GMT Jason 2011-05-10T21:52:34Z Settings to improve Splunk performance on high-spec boxes? https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99223#M1196 <P>Are there any settings that can be set to help Splunk make better use of a high-end box? (I'm currently working with 16x2.4G core, 64GB RAM box.) I was asked if we can "push more things to memory."</P> Tue, 10 May 2011 21:52:34 GMT https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99223#M1196 Jason 2011-05-10T21:52:34Z Re: Settings to improve Splunk performance on high-spec boxes? https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99224#M1197 <P>Is there a specific aspect of performance you want to improve? On a Linux OS, you can (with some trouble to deconflict port numbers, serverName and default host names in server.conf and web.conf) run multiple instances of Splunk on the same box. I would start with two instances, both of them indexing, and one of them distributing search to the other. </P> <P>More physical memory in general will be used by the OS as a disk cache automatically, but sometimes with the amounts of data being handled by Splunk, this isn't terribly effective.</P> Tue, 10 May 2011 22:50:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99224#M1197 gkanapathy 2011-05-10T22:50:07Z Re: Settings to improve Splunk performance on high-spec boxes? https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99225#M1198 <P>Not really, just in general. We ended up going with two instances on each box for HA purposes.</P> Wed, 11 May 2011 17:16:57 GMT https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99225#M1198 Jason 2011-05-11T17:16:57Z Re: Settings to improve Splunk performance on high-spec boxes? https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99226#M1199 <P>Indexing and search should already using memory as disk cache via the OS/filesystem. Mostly Splunk is not memory-intensive, so extra memory is mostly useful as disk cache. A Ram disk in this case would not be any better.</P> Wed, 11 May 2011 17:23:55 GMT https://community.splunk.com/t5/Monitoring-Splunk/Settings-to-improve-Splunk-performance-on-high-spec-boxes/m-p/99226#M1199 gkanapathy 2011-05-11T17:23:55Z