Splunk Search

max_memtable_bytes and Performance?

From a performance perspective, am I better to increase memtablebytes in limits.conf to encompass my (very large) lookups files, or am I better to simply have them be indexed, and lower memtablebytes?

0 Karma

Splunk Employee
Splunk Employee

from a search performance perspective you would want to raise the maxmemtablebytes to encompass your large lookups, but realize that your RAM memory will start to swap if you start utilizing memory system wide too much.

0 Karma