Splunk Enterprise

Does wiredtiger support kvstore acceleration?

ktc78
Explorer

I'm running Splunk Enterprise 8.1.2 & its storage engine is 'mmapv1'

And I tested to migrate 'wiredTiger' ... but I'm afraid acceleration cannot work


Belows are steps I've done on test env.

1. I made test splunk env. - just same with my officially operating splunk system

    And import some of kvstore collections into test splunk (with same collections.conf & transform.conf)

[TEST.kvstore]
field.date = number
field.id = number
field.type = string
field.version = string
accelerated_fields.test = {"id":-1, "date":-1}

 

2. On test splunk (with no changes has been made yet - mmap1), everything worked well

     I got similar lookup search time than original's

 

3. And then I changed storage engine to 'wiredTiger'
        https://docs.splunk.com/Documentation/Splunk/8.2.9/Admin/MigrateKVstore?ref=hk

 This member:
                   backupRestoreStatus : Ready
...
                                  port : 8191
                            replicaSet : DB79F8EF-3560-4A6C-B38E-FF06F1D54661
                     replicationStatus : KV store captain
                            standalone : 1
                                status : ready
                         storageEngine : wiredTiger

 

4. Finally I checked lookup search time on wiredtiger engine 
     "But lookup search time took much more than I expected"

       ㆍmmapv1 : 52 sec

       ㆍwiredtiger : 90 sec

 

So I checked what's wrong with test splunk and I found 'no kvstore accelerations'

(There it was... but disappeared after migration to wiredtiger)

 

Before (mmapv1)

before.png

After (wiredtiger)

after.png

 

I even tried to import new kvstore collection but also failed (no acceleration was made)

 

Does wiredtiger supports kvstore acceleration?

If so, which configuration should I use?

Labels (3)
0 Karma

woodcock
Esteemed Legend

Definitely open a support case.

0 Karma

ktc78
Explorer

Sure I will

I just shared this issue on comminity for non-support version of 3.1.2 that I tested

Thank you for your advice

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...