Search Head pool on RAMdisk

[ejpulsar]

Hi,
As I know, search head pool needs a tremendous IOPS to operate fast. Last "good to go" configuration i've heard from splunk architect was 10k IOPS per search peer.

If I'll setup 30GB RAMDISK with Linux tmpfs, sharing it over tuned NFS to another head and supplying it with proper rsync scripted "backend", will it sounds good?

[johnebgood]

I'm experimenting with ramdisks myself. You can't use tmpfs as Splunk throws an error but you can increase the possible ramdisk size via kernel options and use mkfs on a /dev/ramX device. In grub just edit your kernel line and append ramdisk_size=X

kernel /vmlinuz-2.6.32.24 ro root=LABEL=/ rhgb quiet ramdisk_size=4000000

This is for a max ramdisk size of 4gb.

Then:
mkfs /dev/ram0 4000000
mkdir /mnt/ramdisk0
mount /dev/ram0 /mnt/ramdisk0

Interested to hear your results with the search head pool, I'm currently testing on an indexer and I am observing what appears to be blazing speed but the verdict is still out on total improvement. Will report back with more.

[Lucas_K]

Bump. Just wondering how this ended up working out?

[ejpulsar]

Hi!

Yes, we've got nearly 100k sustained IOPS on RHEL HA Storage and NFS.
But this configuration is not moved to production, we've decide to stand on SSD's.