SmartStore Cache Eviction on Low‑Traffic Indexes: Uncertain Search Latency
The goal is to reduce on‑premise storage costs for a low‑traffic Splunk Enterprise 9.x deployment by moving infrequently accessed data to SmartStore while maintaining acceptable search latency. A key constraint is that the index receives only a few megabytes of events per day, so the cache manager may evict data frequently when the configured max_cache_size
splunk