Splunk Enterprise

Smartstore hotlist_recency_secs

coreyCLI
Communicator

I have an index with the hotlist_recency_secs set to 90 days (7776000 seconds).  In testing I ran searches for the past 30 days.  I noticed in the "Smartstore Cache Performance" dashboard that this 30 days search is triggering "misses".  Meaning that this 30 days search is downloading buckets from S3.  Why would a 30 days search on an index with hotlist_recency_secs set to 90 days need to download buckets for only a 30 day timeframe?  I assume either I have something misconfigured, or more likely, I am not fully understanding the eviction process?  the cachemanager, homePath setting, has 15tb per indexer so I don't believe its running out of space.

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You're correct.  Those setting say to use all but 10GB of the 15TB so you should have plenty of storage.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The hotlist_recency_secs setting does not prevent a bucket from being evicted from the cache.  The goal is to keep the bucket in the cache for (at least) that long, but other demands on the cache may force an early eviction.

We can't tell is 15TB is enough cache space without knowing the ingestion rate.  For example, at 1TB/day, it would only hold 15 days of data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

coreyCLI
Communicator

Tracking.  I have 6 clustered indexers and roughly 300gb per day (right now) of ingest.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

15TB should be enough at 300GB/day.  Double-check the max_cache_size, min_free_space, and eviction_padding settings to ensure the entire space is available.

---
If this reply helps you, Karma would be appreciated.
0 Karma

coreyCLI
Communicator

Settings are defaults:

max_cache_size = 0

minFreeSpace = 5000

eviction_padding = 5120


So, if I am reading and understanding this correctly.  Cachemanager will use the entire 15tb use for homePath and only start evicting buckets using the sum of minFreeSpace + eviction_padding = 10120 MB (roughly 10gb of free space left)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're correct.  Those setting say to use all but 10GB of the 15TB so you should have plenty of storage.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...