Knowledge Management

SmartStore Eviction Behavior

jamie00171
Communicator

I'm looking to get a better understanding of when the cache manager will evict a bucket or at least the journal and tsidx files.

I'm using the default eviction policy (lru) so when the cache becomes full I assume the bucket(s) with the oldest last accessed time are evicted? How does the cache manager determine how many buckets need to be evicted? Does it look at the buckets that need to be downloaded into the cache and determine the amount of space that needs to be evicted in order for those buckets to fit?

I'm also interested under what conditions the cache manager considers a bucket "stale" (it doesn't have a high likelihood of participating in a future search). How long has to pass without the bucket being accessed before it is considered stale?

The docs also state that one of the characteristics common to most Splunk deployments searches is that:

They have spatial and temporal locality. If a search finds an event at a specific time or in a specific log, it's likely that other searches will look for events within a closely similar time range or in that log.

Does this mean if a bucket is needed for a search will other buckets that have their earliest_time & latest_time within a certain time range of this bucket will be less likely to be evicted?

Many Thanks,

Jamie

Labels (1)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...