Deployment Architecture

Search Head pool on RAMdisk

ejpulsar
Path Finder

Hi,
As I know, search head pool needs a tremendous IOPS to operate fast. Last "good to go" configuration i've heard from splunk architect was 10k IOPS per search peer.

If I'll setup 30GB RAMDISK with Linux tmpfs, sharing it over tuned NFS to another head and supplying it with proper rsync scripted "backend", will it sounds good?

Tags (2)

johnebgood
Path Finder

I'm experimenting with ramdisks myself. You can't use tmpfs as Splunk throws an error but you can increase the possible ramdisk size via kernel options and use mkfs on a /dev/ramX device. In grub just edit your kernel line and append ramdisk_size=X

kernel /vmlinuz-2.6.32.24 ro root=LABEL=/ rhgb quiet ramdisk_size=4000000

This is for a max ramdisk size of 4gb.

Then:
mkfs /dev/ram0 4000000
mkdir /mnt/ramdisk0
mount /dev/ram0 /mnt/ramdisk0

Interested to hear your results with the search head pool, I'm currently testing on an indexer and I am observing what appears to be blazing speed but the verdict is still out on total improvement. Will report back with more.

0 Karma

Lucas_K
Motivator

Bump. Just wondering how this ended up working out?

0 Karma

ejpulsar
Path Finder

Hi!

Yes, we've got nearly 100k sustained IOPS on RHEL HA Storage and NFS.
But this configuration is not moved to production, we've decide to stand on SSD's.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...