Access Data Insights Faster by Deploying Splunk Enterprise with VMware Tanzu
Download PDFTue, 17 Jan 2023 05:06:20 -0000
|Read Time: 0 minutes
Summary
Splunk Enterprise containerized deployments with VMWare Tanzu can deliver substantial business benefits. In this brief, Intel and Dell technologists discuss key considerations to successfully deploy Splunk based containers, with recommendations on configurations based on the most recent 15th Generation PowerEdge Server portfolio offerings.
Enterprises have massive amounts of data available, but in raw form: there is still a lot of work to do. Data comes from different sources, in different structures, and on different time scales. To pull data together for analysis and gain insights for business transformation, enterprises turn to Splunk Enterprise, a data-analytics platform that enables enterprises to monitor, analyze, and act on data. The resulting insights enable decision makers to identify security threats, optimize application performance, understand customer behavior, and more.
To deploy Splunk Enterprise more efficiently, organizations are using Kubernetes container orchestration through tools like VMware Tanzu. Containers are lightweight, efficient ways to deploy and manage applications.
This article outlines recommended hardware configurations for deploying Splunk Enterprise with VMware Tanzu on Dell PowerEdge servers. These configurations feature Intel® Xeon® Scalable processors, Intel® Optane™ storage and Intel® Ethernet Network Adapters to enable high performance.
Key Considerations
Key considerations for deploying Splunk using VMware Tanzu include the following. Note that VMware Tanzu is deployed on VMware vSphere with VMware vSAN underneath.
- Size persistent volumes based on ingestion rate. Persistent volumes are stored on the vSAN storage and should be sized according to the expected ingestion rate and hot data retention period. More and/or larger drives for vSAN can be used if necessary.
- Use high-performance or high-capacity configurations for object storage. Object storage capacity can be scaled independently of worker nodes by deploying additional storage nodes. Both high- performance (with NVM Express [NVMe] solid-state drives [SSDs]) and high-capacity (with rotational hard-disk drives [HDDs]) configurations can be used. An in-cluster solution based on MinIO is recommended. Alternatively, an external S3-compatible object store like Dell PowerScale (Isilon) or Elastic Cloud Storage (ECS) is an option. An additional network interface controller (NIC) can be used for dedicated network storage. Contact Dell Technologies for help choosing the proper storage solution.
- Deploy VMware vCenter management virtual machines (VMs). Deploy VMware vCenter management VMs on the same cluster. Deployment outside the cluster on a separate machine is not covered in this hardware bill of materials (BoM).
Available Configurations
Node Type | Splunk Worker Nodes (Minimum of 4 Nodes Required, up to 64 Nodes per Cluster) | Optional Dedicated Storage Nodes | |||
High Performance | High Capacity | ||||
Platform | Dell PowerEdge R750 server supporting 16 x 2.5” drives with NVMe backplane— direct connection | Dell PowerEdge R650 server supporting 10 x 2.5” drives with NVMe backplane | Dell PowerEdge R750 supporting 12 x 3.5” drives with Serial- Attached SCSI (SAS)/Serial ATA (SATA) backplane | ||
CPU | Base Configuration | Plus Configuration | 2 x Intel® Xeon® Gold 6342 processor (24 cores at 2.8 GHz) | 2 x Intel® Xeon® Gold 6326 processor (16 cores at 2.9 GHz) | |
2 x Intel® Xeon® Gold 6348 processor (28 cores at 2.6 GHz) | 2 x Intel® Xeon® Platinum 8360Y processor (36 cores at 2.4 GHz) | ||||
DRAM | 256 GB (16 x 16 GB DDR4-3200) | 512 GB (16 x 32 GB DDR4-3200) | 128 GB (16 x 8 GB DDR4-3200) | ||
Storage controller | Not applicable (N/A) | HBA355i adapter | |||
Persistent memory | Optional | N/A | |||
Boot device | Dell Boot Optimized Server Storage (BOSS)-S2 with 2 x 480 GB M.2 SATA SSD (RAID1) | ||||
VMware vSAN cache tieri | 2 x 400 GB Intel® Optane™ SSD P5800X (PCIe Gen4) |
N/A | |||
VMware vSAN capacity tierii | 4 x 1.92 TB or 3.84 TB Intel® SSD P5500 (PCIe Gen4, read-intensive) | N/A | |||
Object storageiii | 4 x (up to 10 x) 1.92 TB, 3.84 TB or 7.68 TB Intel® SSD P5500 (PCIe Gen4, read- intensive) | Up to 10 x 1.92 TB, 3.84 TB or 7.68 TB Intel® SSD P5500 (PCIe Gen4, read-intensive) | Up to 12 x 8 TB, 12 TB or 18 TB 3.5-in 12 Gbps SAS HDD, 7.2K rotations per minute (RPM) | ||
NICiv |
Intel® Ethernet Network Adapter E810- XXV for OCP3 (dual-port 25 Gb) or Intel® Ethernet Network Adapter E810-CQDA2 PCIe add-on card (dual-port 100 Gb) | Intel® Ethernet Network Adapter E810-CQDA2 PCIe add-on card (dual-port 100 Gb) | Intel® Ethernet Network Adapter E810-XXV for OCP3 (dual-port 25 Gb) | ||
Additional NICv | Intel® Ethernet Network Adapter E810- XXV for OCP3 (dual-port 25 Gb) or Intel® Ethernet Network Adapter E810-CQDA2 PCIe add-on card (dual-port 100 Gb) |
N/A | |||
Learn More
Written With Intel
Contact your dedicated Dell or Intel account team for a customized quote. 1-877-289-3355 “Build High Performance Splunk SmartStores with MinIO”
“Harness the Power of Splunk with Dell Storage”
i VMware vSAN storage used for VMs and container ephemeral and persistent volumes.
ii VMware vSAN storage used for VMs and container ephemeral and persistent volumes.
iii Number of drives and capacity for MinIO object storage depends on the dataset size and performance requirements.
iv 100 Gb NICs recommended for higher throughput.
v Optional; required only if a dedicated storage network for external storage system is necessary.