I just watched a storage vendor claim that "hot buckets are all in memory"....

[lycollicott]

Does he know something I don't? I never heard that claim before.

[skoelpin · Accepted solution]

I've seen it done before, but by default, this is not correct.

You could show him /splunk/var/lib/splunk/<index_name>/db and view the hot buckets which are being written to disk..

[woodcock]

Agreed, there are many amazing storage solutions, many of which cache in RAM invisibly, but this is storage tier magic (and very vendor/solution specific), not a general truth.

[lycollicott]

That's what I thought, too, but didn't want to call BS without a little research first.

[MuS]

If you are brave enough to use tmpfs for your hot storage, then yes 😉
Maybe this claim was related to the storage system has some internal cache which keeps open files in its internal memory before writing to disk? ¯\_(ツ)_/¯

[lycollicott]

LOL, yeah. We're getting a Webex demo from them this month, so I'm going to watching for it.