Splunk Enterprise has been deployed and validated on PowerFlex rack with following design:
Optimized the design for both high performance and data retention capability using PowerFlex rack for storage of hot/warm and PowerScale is integrated to provide configurable cold data bucket retention
For this validation, 50 GB of log data is generated and forwarded through a universal forwarder, the data gets indexed and the events are stored in the hot buckets, where the events can be searched using a search head. Once the warm bucket volume size exceeds the specified limit, the data is rolled back into the PowerScale cold bucket.