Deploy Splunk Enterprise Efficiently with Red Hat OpenShift on Dell Servers with Intel® Technologies
Download PDFTue, 17 Jan 2023 05:13:39 -0000
|Read Time: 0 minutes
Summary
Splunk Enterprise containerized deployments with Red Hat OpenShift can deliver substantial business benefits. In this brief, Intel and Dell technologists discuss key considerations to successfully deploy Splunk based containers, with recommendations on configurations based on the most recent 15th Generation PowerEdge Server portfolio offerings.
Integrating data strategy into business strategy is key to digital transformation. To harness the value of untapped data, many organizations are turning to Splunk Enterprise, a high-performance data-analytics platform that enables decision makers to bring data to every question, decision, and action.
To deploy workloads like Splunk Enterprise more efficiently, IT architects are choosing containerization. Red Hat OpenShift, an enterprise-ready Kubernetes container platform, is a popular choice. By using Red Hat OpenShift, architects don’t need to separate dedicated nodes for each Splunk Enterprise function, and they can add more nodes and scale them separately from storage.
Intel and Splunk have partnered to develop recommended hardware configurations for deploying Splunk Enterprise with Red Hat OpenShift on Dell PowerEdge servers. Organizations that use these configurations can benefit from the high performance enabled by Intel® compute, storage, and network technologies.
Key Considerations
Key considerations for deploying Splunk Enterprise with Red Hat OpenShift successfully include:
- Size local NVM Express (NVMe) storage. Size local NVMe storage for persistent volumes according to the expected ingestion rate and hot-data-retention period. Size by adding more or larger drives.
- Deploy additional storage nodes. Deploy additional storage nodes to scale object-store capacity for Splunk SmartStore independently of worker nodes. Optimize for the expected ingestion rate and warm or cold data retention using high-performance (with NVMe solid-state drives [SSDs]) or high-capacity (with rotational hard-disk drives [HDDs]) configurations with a set of storage policies. An in- cluster solution based on MinIO is recommended. Alternatively, an external S3-compatible object store like Dell PowerScale (Isilon) or Elastic Cloud Storage (ECS) can be used. For dedicated network storage, an additional network interface controller (NIC) can be used. Contact Dell Technologies for help choosing the proper storage solution.
- Manage NVMe drives. Manage NVMe drives for local and object storage using the Local Storage Operator. If necessary, partition the drives to get more volumes with smaller size. Configure proper redundancy and replication on the application layer.
Available Configurations
| Red Hat OpenShift Control Plane (Master) Nodes-3 Nodes Required | Splunk Worker Nodes | Optional Dedicated Storage Node for Object Storage | ||||
Platform | Dell PowerEdge R650 server supporting 10 x 2.5” drives with NVMe backplane | Dell PowerEdge R750 server supporting 16 x 2.5” drives with NVMe backplane (direct) | Dell PowerEdge R650 server supporting 10 x 2.5” drives with NVMe backplane (direct) | Dell PowerEdge R750 server supporting 12 x 3.5” drives with Serial- Attached SCSI (SAS)/Serial ATA (SATA) backplane | |||
Node type |
| Base configuration | Plus configuration | High performance | High capacity | ||
CPU | 2 x Intel® Xeon® Gold 6326 processor (16 cores at 2.9 GHz) or better | 2 x Intel® Xeon® Gold 6348 processor (28 cores at 2.6 GHz) | 2 x Intel® Xeon® Platinum 8360Y processor (36 cores at 2.4 GHz) | 2 x Intel® Xeon® Gold 6342 processor (24 cores at 2.8 GHz) | 2 x Intel® Xeon® Gold 6326 processor (16 cores at 2.9 GHz) | ||
DRAM | 128 GB (16 x 8 GB DDR4-3200) | 256 GB (16 x 16 GB DDR4-3200) | 512 GB (16 x 32 GB DDR4- 3200) | 128 GB (16 x 8 GB DDR4-3200) | |||
Storage controller | Not applicable (N/A) | HBA355i adapter | |||||
Persistent memory | Not applicable N/A | Optional | N/A | ||||
Boot device | Dell Boot Optimized Server Storage (BOSS)-S2 with 2 x 480 GB M.2 SATA SSD (RAID1) | ||||||
Ephemeral storagei |
1 x 1.6 TB Intel® SSD P5600 NVMe |
1 x 1.6 TB Intel® SSD P5600 (PCIe Gen4, mixed-use) |
N/A | ||||
Local storageii | N/A | 1 x (up to 5 x) 1.6 TB or 3.2 TB Intel® SSD P5600 (PCIe Gen4, mixed-use) | N/A | ||||
Object storageiii |
N/A |
4 x (up to 10 x) 2 TB, 4 TB or 8 TB Intel® SSD P5500 (PCIe Gen4, read-intensive) |
Up to 10 x 2 TB, 4 TB, 8 TB Intel® SSD P5500 (PCIe Gen4, read-intensive) |
Up to 12 x 8 TB, 12 TB, 18 TB 3.5-in 12 Gbps SAS HDD 7.2K rotations per minute (RPM) | |||
Network interface controller (NIC)iv | Intel® Ethernet Network Adapter E810-XXVDA2 for OCP3 (dual-port 25 gigabit Ethernet [GbE]) | Intel® Ethernet Network Adapter E810-XXV for OCP3 (dual-port 25 Gb) or Intel Ethernet Network Adapter E810-CQDA2 PCIe add-on card (dual-port 100 Gb) | Intel® Ethernet Network Adapter E810-CQDA2 PCIe add-on card (dual- port 100 Gb) | Intel® Ethernet Network Adapter E810-XXV for OCP3 (dual-port 25 Gb) | |||
Additional NIC for external storagev |
N/A | Intel® Ethernet Network Adapter E810-XXV PCIe add-on card (dual- port 25 Gb) or Intel® Ethernet Network Adapter E810-CQDA2 PCIe add-on card (dual-port 100 Gb) |
N/A | ||||
Learn More
Contact your dedicated Dell or Intel account team for a customized quote. 1-877-289-3355 “Build High Performance Splunk SmartStores with MinIO”
“Harness the Power of Splunk with Dell Storage”
i Ephemeral storage is used only for container images and ephemeral volumes.
ii Local storage for persistent volumes includes Splunk® hot tier.
iii The number of drives and capacity for MinIO® object storage depends on the dataset size and performance requirements.
iv 100 Gb NICs recommended for higher throughput.
v Optional; required only if dedicated storage network for external storage system is necessary.
Note: This document may contain language from third-party content that is not under
Dell Technologies’ control and is not consistent with current guidelines for Dell Technologies’ own content. When such third-party content is updated by the relevant third parties, this document will be revised accordingly.