I was wondering if anyone uses zram (compressed ram blocks) with Splunk. It seems each time I upgrade Splunk core (especially on indexers), the more hungry memory Splunk core gets. Typically zram is for low ram environments, but I wonder if the compression would help Splunk core from the compression (reliably)? Obviously there would be higher cpu use.
zram info:
[https://www.kernel.org/doc/Documentation/blockdev/zram.txt][1]
[1]: https://www.kernel.org/doc/Documentation/blockdev/zram.txt
↧