Splunk Enterprise

Smartstore hotlist_recency_secs

coreyCLI
Communicator

I have an index with the hotlist_recency_secs set to 90 days (7776000 seconds).  In testing I ran searches for the past 30 days.  I noticed in the "Smartstore Cache Performance" dashboard that this 30 days search is triggering "misses".  Meaning that this 30 days search is downloading buckets from S3.  Why would a 30 days search on an index with hotlist_recency_secs set to 90 days need to download buckets for only a 30 day timeframe?  I assume either I have something misconfigured, or more likely, I am not fully understanding the eviction process?  the cachemanager, homePath setting, has 15tb per indexer so I don't believe its running out of space.

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You're correct.  Those setting say to use all but 10GB of the 15TB so you should have plenty of storage.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The hotlist_recency_secs setting does not prevent a bucket from being evicted from the cache.  The goal is to keep the bucket in the cache for (at least) that long, but other demands on the cache may force an early eviction.

We can't tell is 15TB is enough cache space without knowing the ingestion rate.  For example, at 1TB/day, it would only hold 15 days of data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

coreyCLI
Communicator

Tracking.  I have 6 clustered indexers and roughly 300gb per day (right now) of ingest.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

15TB should be enough at 300GB/day.  Double-check the max_cache_size, min_free_space, and eviction_padding settings to ensure the entire space is available.

---
If this reply helps you, Karma would be appreciated.
0 Karma

coreyCLI
Communicator

Settings are defaults:

max_cache_size = 0

minFreeSpace = 5000

eviction_padding = 5120


So, if I am reading and understanding this correctly.  Cachemanager will use the entire 15tb use for homePath and only start evicting buckets using the sum of minFreeSpace + eviction_padding = 10120 MB (roughly 10gb of free space left)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're correct.  Those setting say to use all but 10GB of the 15TB so you should have plenty of storage.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...