Knowledge Management

SmartStore Eviction Behavior


I'm looking to get a better understanding of when the cache manager will evict a bucket or at least the journal and tsidx files.

I'm using the default eviction policy (lru) so when the cache becomes full I assume the bucket(s) with the oldest last accessed time are evicted? How does the cache manager determine how many buckets need to be evicted? Does it look at the buckets that need to be downloaded into the cache and determine the amount of space that needs to be evicted in order for those buckets to fit?

I'm also interested under what conditions the cache manager considers a bucket "stale" (it doesn't have a high likelihood of participating in a future search). How long has to pass without the bucket being accessed before it is considered stale?

The docs also state that one of the characteristics common to most Splunk deployments searches is that:

They have spatial and temporal locality. If a search finds an event at a specific time or in a specific log, it's likely that other searches will look for events within a closely similar time range or in that log.

Does this mean if a bucket is needed for a search will other buckets that have their earliest_time & latest_time within a certain time range of this bucket will be less likely to be evicted?

Many Thanks,


Labels (1)
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...