Hi,
Some time ago we mounted /opt/splunk/var/run/splunk/dispatch on our search heads to RAM storage to increase performance. This seemed to have worked just fine, and performance was indeed increased. The downside is that dispatch is flushed when the search heads reboot, but that's okay in our case. Now we're thinking about mounting the whole run directory (/opt/splunk/var/run) to RAM storage to increase performance even further. Is there any obvious flaws with this? Is there anything in the run directory that would cause problems if being deleted at reboot?
↧
