This solution implements the following Dell EMC and VMware best practices to provide optimal performance for all Splunk Enterprise virtual machines running on the PowerFlex rack.
- Create a vSphere HA cluster to provide a virtualized, high-availability Splunk Enterprise environment that is easy to use and cost-effective.
- Use a VMware VMXNET3 network adapter to optimize network performance.
- Splunk Enterprise is resource-intensive. For best performance, do not overcommit vCPU or memory for Splunk instances.
- Use thick provisioned eager zeroed disk to optimize virtual disk performance. Use a single virtual socket for each virtual machine. With virtual Non-Uniform Memory Access (NUMA) topology, a single virtual socket that has fewer virtual CPU cores than the physical CPU cores of a socket in the physical ESXi host is recommended.
- Use a VMware Paravirtual SCSI controller to increase throughput with significant CPU utilization reduction in the SAN environment.
- Install VMware tools in the guest Operating System to improve virtual machine (VM) performance.
- Set the VM advance parameters numa.vcpu.preferHT to “true” for enabling hyperthreading with NUMA in ESXi.
- It is strongly recommended to follow the PowerFlex rack standard best practices guide for cluster formation and network configuration.
Isilon Best Practices
- Enable Smart Pools settings across all Isilon nodes and use an SSD as L3 cache for random read acceleration
- Enable SmartConnect to provide automatic client connection load balancing and failover capabilities
- Enable SmartCache for write performance
- Use Optimization for concurrent data access pattern
- Use 10 Gb/s external network for data connection
- Increase network MTU to 9000 (Jumbo Frames)