https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319468#M166179 <P>HOT and WARM are on the same filesystem; you cannot separate that. The only real difference between HOT and WARM buckets is that HOT buckets are open for R/W whereas WARM buckets are read-only.<BR /> Splunk really doesn't care how you implement the HOT/WARM storage as long as it is exposed as a supported filesystem. <BR /> You will very definitely want to very carefully assess your failure scenarios with RAM disk.</P> Wed, 06 Sep 2017 17:25:06 GMT s2_splunk 2017-09-06T17:25:06Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319467#M166178 <P>All, </P> <P>Just day dreaming here a little as I read the indexes.conf file documentation a bit. I was thinking, assuming you're willing to risk the data loss wouldn't it make sense to house your Hot buckets to a RAM disk, then roll from HOT to warm to actual disk?</P> <P>Crazy? </P> <P><A href="https://www.jamescoyle.net/how-to/943-create-a-ram-disk-in-linux">https://www.jamescoyle.net/how-to/943-create-a-ram-disk-in-linux</A></P> Wed, 06 Sep 2017 17:18:52 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319467#M166178 daniel333 2017-09-06T17:18:52Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319468#M166179 <P>HOT and WARM are on the same filesystem; you cannot separate that. The only real difference between HOT and WARM buckets is that HOT buckets are open for R/W whereas WARM buckets are read-only.<BR /> Splunk really doesn't care how you implement the HOT/WARM storage as long as it is exposed as a supported filesystem. <BR /> You will very definitely want to very carefully assess your failure scenarios with RAM disk.</P> Wed, 06 Sep 2017 17:25:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319468#M166179 s2_splunk 2017-09-06T17:25:06Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319469#M166180 <P>I concur with the above.</P> <P>Also consider the limitation of maybe at most 512gb available...</P> <P>Would be great for a very specific use case though!</P> Wed, 06 Sep 2017 18:07:43 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319469#M166180 jkat54 2017-09-06T18:07:43Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319470#M166181 <P>An unscheduled reboot will loose all the data from a RAMdisk. and since some hot buckets stay around a long time, you would loose all that data. You'd also loose the warm buckets, too, since they have to reside on the same FS.</P> Wed, 06 Sep 2017 18:54:03 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319470#M166181 cpetterborg 2017-09-06T18:54:03Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319471#M166182 <P>True. </P> <BLOCKQUOTE> <P>You will very definitely want to very carefully assess your failure scenarios with RAM disk.</P> </BLOCKQUOTE> <P>In other words: Don't do this without Splunk index replication. Spread your indexers across multiple racks/switches/PDUs/etc.<BR /> Even after doing anything you can think of, accept the remaining risk of losing data due to catastrophic failures.</P> Wed, 06 Sep 2017 18:58:30 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319471#M166182 s2_splunk 2017-09-06T18:58:30Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319472#M166183 <P>Also consider what will happen when a server requires a reboot for maintenance purposes.</P> Fri, 08 Sep 2017 07:08:25 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-mount-HOT-to-a-ram-disk-for-performance/m-p/319472#M166183 gjanders 2017-09-08T07:08:25Z