Knowledge Management

[Smartstore] Can indexes spread across two file systems, can the max_cache_size setting be set per file system? Or is it global ?

rbal_splunk
Splunk Employee
Splunk Employee

Deployment has 30 indexers and 100 indexes
Each indexer has two 10TB filesystem ( /data1/indexes/... and /data2/indexes/..) . and both file systems have active indexes.
Half of the indexes use homepath of /data1/indexes/... and other have /data2/indexes/..)
How does a 5TB “max_cache_size” setting work?
Is it when either one of the filesystems reaches 5TB, is it when both file systems combined reach 5TB.
I would expect it to be both file systems combined reach 5TB.

Tags (1)
0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

max_cache_size corresponds to a file system as opposed to the complete set of filesystems.
Hence the setting kicks in when either of the file systems reaches 5TB.

One downside with evicting buckets when "both file systems combined reach 5TB" is that
both of the file systems would not be used optimally as in buckets would get evicted when,
say both of them are at 2.5 TB thus ending up never using the other 5TB.

Hence max_cache_size is considered on a standalone basis

View solution in original post

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

max_cache_size corresponds to a file system as opposed to the complete set of filesystems.
Hence the setting kicks in when either of the file systems reaches 5TB.

One downside with evicting buckets when "both file systems combined reach 5TB" is that
both of the file systems would not be used optimally as in buckets would get evicted when,
say both of them are at 2.5 TB thus ending up never using the other 5TB.

Hence max_cache_size is considered on a standalone basis

0 Karma

gjanders
SplunkTrust
SplunkTrust

Would you mind clarifying this answer, I'm not sure I understand the answer here.

Are you saying max_cache_size applies globally so that if either filesystem reaches 5TB in your example then eviction occurs?
Or that the combined filesystems reach 5TB then eviction starts occurring?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

When the combined filesystems reach 5TB then eviction starts occurring?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...