- Create a subnet.
- Log in to the PowerScale web service using the root account.
- Go to Cluster Management > Network Configuration.
- Click More > Add Subnet of groupnet0 to create a subnet.
- Create an access zone.
- Go to Access > Access Zones.
- Click Create an access zone to create an access zone for Splunk.
- Create an IP address pool.
- Go to Cluster Management > Network Configuration.
- Click More > Add Pool of subnet-10g to create an IP address pool.
- Create NFS Export.
- Go to Protocols > UNIX Sharing (NFS) > NFS Exports.
- Select the Current Access Zone as Splunk.
- Click Create Export and provide required details.
- Add PowerScale NFS storage to PowerFlex rack.
- Log in to the vCenter client using the administrator account.
- Go to Home > Inventory > Hosts and Clusters > ESXi server > Configure > Storage > Datastores.
- Click Add data store and provide required details.
- Add PowerScale cold Storage to each indexer VM and follow the procedure.
- Log in to the vCenter client using the administrator account.
- Click Indexer VM and Edit settings.
- Click New Hard Disk and Add.
- Provide the necessary details.
- Prepare Splunk Cold buckets using PowerScale disks on VMs.
- Log in to the indexer using SSH.
- Make a partition on the newly provisioned PowerScale virtual disk:
fdisk /dev/sdd
- Make a file system on the partition:
mkfs.xfs -f /dev/sdd1
- Create a directory and mount the PowerScale virtual disk to a separate mount point
mkdir -p /data/splunk/isilon_colddb
chmod -R 750 /data/splunk/isilon_colddb
chown -R splunk:splunk /data/splunk/isilon_colddb
mount /dev/sdd1 /data/splunk/isilon_colddb
vi /etc/fstab
/dev/sdd1 /data/splunk/isilon_colddb xfs defaults 0 0
- Create a new configuration file indexes.conf in each indexer VM.
- Go to the path $SPLUNK_HOME/etc/system/local/indexes and add the following configuration for 30-day hot/warm retention and required configurable cold data retention
#volume definitions
[volume:hotwarm]
path = /data/splunk/homedb
[volume:cold]
path = /data/splunk/Isilon_colddb
# index definition (calculation is based on a single index)
[main]
homePath = volume:hotwarm/defaultdb/db
coldPath = volume:cold/defaultdb/colddb
homePath.maxDataSizeMB = 768000
coldPath.maxDataSizeMB = [configurable]
- /opt/splunk/bin/splunk restart
Note: The configuration can be modified based on retention needs and any number of parameters can be added. For more information about indexes configuration details, see indexes.conf.