Splunk Enterprise has been deployed and validated on PowerFlex rack with following design:
Optimized the design for both high performance and data retention capability using PowerFlex rack for storage of hot/warm and Isilon is integrated to provide configurable cold data bucket retention
For this validation, a 50 GB log data is generated and forwarded it via universal forwarder, the data gets indexed and stores the events in hot bucket, where the events can be searched using search head. Once the warm bucket volume size exceeds the specified limit, data is rolled into Isilon cold bucket.