Are there any settings that can be set to help Splunk make better use of a high-end box? (I'm currently working with 16x2.4G core, 64GB RAM box.) I was asked if we can "push more things to memory."
Is there a specific aspect of performance you want to improve? On a Linux OS, you can (with some trouble to deconflict port numbers, serverName and default host names in server.conf and web.conf) run multiple instances of Splunk on the same box. I would start with two instances, both of them indexing, and one of them distributing search to the other.
More physical memory in general will be used by the OS as a disk cache automatically, but sometimes with the amounts of data being handled by Splunk, this isn't terribly effective.
Is there a specific aspect of performance you want to improve? On a Linux OS, you can (with some trouble to deconflict port numbers, serverName and default host names in server.conf and web.conf) run multiple instances of Splunk on the same box. I would start with two instances, both of them indexing, and one of them distributing search to the other.
More physical memory in general will be used by the OS as a disk cache automatically, but sometimes with the amounts of data being handled by Splunk, this isn't terribly effective.
Indexing and search should already using memory as disk cache via the OS/filesystem. Mostly Splunk is not memory-intensive, so extra memory is mostly useful as disk cache. A Ram disk in this case would not be any better.
Not really, just in general. We ended up going with two instances on each box for HA purposes.