This section describes the vSAN storage design for the five types of Splunk Enterprise deployment on a VxRail cluster described earlier.
In this solution, we used a default vSAN storage policy and a custom policy:
The following table shows the vSAN storage policies that are defined for the virtual machines:
Table 7. vSAN storage policy configuration
Policy name | Rulesets | Comments |
vSAN Default Storage Policy |
| This policy is the vSAN default policy. It is used for the VM home files and operating system VMDK files of virtual machines created in this solution. |
User created Splunk-Data-Policy |
| This policy is used for Splunk indexer data storage. |
Table 8. vSAN storage design for Splunk
Deployment type | Instance role | Quantity | Operating system storage | Indexer storage |
Single Instance 50 GB/day with 90-day retention | Single instance combined search head and indexer | 1 | 300 GB | 3 TB |
Multi-instance 500 GB/day with 90-day retention | Search Head | 1 | 300 GB | 0 |
Indexer | 2 | 300 GB | 13.9 TB | |
Admin Server | 1 | 150 GB | 0 | |
Multi-instance 1000 GB/day with 90-day retention | Search Head | 1 | 300 GB | 0 |
Indexer | 5 | 300 GB | 10.8 TB | |
Admin Server | 1 | 150 GB | 0 | |
Multi-instance 1000 GB/day with > 90-day retention | Search Head | 1 | 300 GB | 0 |
Indexer | 5 | 300 GB | 2.1 TB | |
Admin Server | 1 | 150 GB | 0 | |
Multi-instance 1000 GB/day with > 90-day retention and Indexer High Availability | Search Head | 1 | 300 GB | 0 |
Indexer | 5 | 300 GB | 2.1 TB | |
Admin Server | 1 | 150 GB | 0 |
In the solution shown in Figure 2, a four-node Isilon H500 cluster is used for the Splunk deployment to provide configurable retention for cold buckets. The following tables show the detailed Isilon node configuration and Isilon storage design for Splunk:
Table 9. Isilon node configuration
CPU | CPU cores | RAM | SSD capacity | HDD capacity | Network |
Two Intel Xeon Processor E5-2630 v4 | 10 cores | 128 GB | 1.6 TB or 3.2 TB (1 or 2 drives) | 120 – 960 TB | 2 x 10 GbE 2 x 25 GbE 2 x 40 GbE |
Table 10. Isilon storage design for Splunk
Deployment Type | Instance Role | Quantity | Indexer Cold Bucket Storage |
Multi-instance 1000 GB/day with > 90-day Retention | Indexer | 5 | 10.8 TB |
Multi-instance 1000 GB/day with > 90-day Retention and Indexer High Availability | Indexer | 5 | 10.8 TB |
For the Isilon configuration, we followed these best practices:
Splunk and Dell Technologies recommend that NFS storage, including PowerScale storage, is only used for cold and frozen data, never for hot/warm. For details about system requirements, see the Splunk Enterprise Installation Manual.
The Splunk storage sizing tool at http://splunk-sizing.appspot.com/ can provide an estimated storage requirement for beginning your design planning. However, Splunk states that this tool is not 100 percent accurate. A Dell technologist can assist you with the complete solution design.