On the indexers we have 64 GBs of RAM.
We have the following configurations -
[queue=AEQ]
maxSize = 200MB
[queue=parsingQueue]
maxSize = 3600MB
[queue=indexQueue]
maxSize = 4000MB
[queue=typingQueue]
maxSize = 2100MB
[queue=aggQueue]
maxSize = 3500MB
So, the processing queues can consume altogether up to 13.4 GBs and currently we are at 100% for all the queues. We wonder how high we can set them up while leaving enough RAM for the Splunk processes.
The servers are fully dedicated to Splunk...
↧