Knowledge Management

[Smartstore] Can indexes spread across two file systems, can the max_cache_size setting be set per file system? Or is it global ?

rbal_splunk
Splunk Employee
Splunk Employee

Deployment has 30 indexers and 100 indexes
Each indexer has two 10TB filesystem ( /data1/indexes/... and /data2/indexes/..) . and both file systems have active indexes.
Half of the indexes use homepath of /data1/indexes/... and other have /data2/indexes/..)
How does a 5TB “max_cache_size” setting work?
Is it when either one of the filesystems reaches 5TB, is it when both file systems combined reach 5TB.
I would expect it to be both file systems combined reach 5TB.

Tags (1)
0 Karma
1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

max_cache_size corresponds to a file system as opposed to the complete set of filesystems.
Hence the setting kicks in when either of the file systems reaches 5TB.

One downside with evicting buckets when "both file systems combined reach 5TB" is that
both of the file systems would not be used optimally as in buckets would get evicted when,
say both of them are at 2.5 TB thus ending up never using the other 5TB.

Hence max_cache_size is considered on a standalone basis

View solution in original post

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

max_cache_size corresponds to a file system as opposed to the complete set of filesystems.
Hence the setting kicks in when either of the file systems reaches 5TB.

One downside with evicting buckets when "both file systems combined reach 5TB" is that
both of the file systems would not be used optimally as in buckets would get evicted when,
say both of them are at 2.5 TB thus ending up never using the other 5TB.

Hence max_cache_size is considered on a standalone basis

0 Karma

gjanders
SplunkTrust
SplunkTrust

Would you mind clarifying this answer, I'm not sure I understand the answer here.

Are you saying max_cache_size applies globally so that if either filesystem reaches 5TB in your example then eviction occurs?
Or that the combined filesystems reach 5TB then eviction starts occurring?

0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

When the combined filesystems reach 5TB then eviction starts occurring?

0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...