Knowledge Management

[Smartstore] Can indexes spread across two file systems, can the max_cache_size setting be set per file system? Or is it global ?

rbal_splunk
Splunk Employee
Splunk Employee

Deployment has 30 indexers and 100 indexes
Each indexer has two 10TB filesystem ( /data1/indexes/... and /data2/indexes/..) . and both file systems have active indexes.
Half of the indexes use homepath of /data1/indexes/... and other have /data2/indexes/..)
How does a 5TB “max_cache_size” setting work?
Is it when either one of the filesystems reaches 5TB, is it when both file systems combined reach 5TB.
I would expect it to be both file systems combined reach 5TB.

Tags (1)
0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

max_cache_size corresponds to a file system as opposed to the complete set of filesystems.
Hence the setting kicks in when either of the file systems reaches 5TB.

One downside with evicting buckets when "both file systems combined reach 5TB" is that
both of the file systems would not be used optimally as in buckets would get evicted when,
say both of them are at 2.5 TB thus ending up never using the other 5TB.

Hence max_cache_size is considered on a standalone basis

View solution in original post

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

max_cache_size corresponds to a file system as opposed to the complete set of filesystems.
Hence the setting kicks in when either of the file systems reaches 5TB.

One downside with evicting buckets when "both file systems combined reach 5TB" is that
both of the file systems would not be used optimally as in buckets would get evicted when,
say both of them are at 2.5 TB thus ending up never using the other 5TB.

Hence max_cache_size is considered on a standalone basis

0 Karma

gjanders
SplunkTrust
SplunkTrust

Would you mind clarifying this answer, I'm not sure I understand the answer here.

Are you saying max_cache_size applies globally so that if either filesystem reaches 5TB in your example then eviction occurs?
Or that the combined filesystems reach 5TB then eviction starts occurring?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

When the combined filesystems reach 5TB then eviction starts occurring?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...