Settings to improve Splunk performance on high-spec boxes?

[Jason]

Are there any settings that can be set to help Splunk make better use of a high-end box? (I'm currently working with 16x2.4G core, 64GB RAM box.) I was asked if we can "push more things to memory."

[gkanapathy · Accepted solution]

Is there a specific aspect of performance you want to improve? On a Linux OS, you can (with some trouble to deconflict port numbers, serverName and default host names in server.conf and web.conf) run multiple instances of Splunk on the same box. I would start with two instances, both of them indexing, and one of them distributing search to the other.

More physical memory in general will be used by the OS as a disk cache automatically, but sometimes with the amounts of data being handled by Splunk, this isn't terribly effective.

[gkanapathy]

Indexing and search should already using memory as disk cache via the OS/filesystem. Mostly Splunk is not memory-intensive, so extra memory is mostly useful as disk cache. A Ram disk in this case would not be any better.

[Jason]

Not really, just in general. We ended up going with two instances on each box for HA purposes.