Experience Higher Performance with Splunk® Enterprise
Download PDFTue, 17 Jan 2023 06:53:02 -0000
|Read Time: 0 minutes
Summary
Splunk deployments require unique server and performance characteristics. In this brief document Intel and Dell technologists discuss key considerations to successful Splunk deployments and recommended configurations based on the most recent 15th Generation PowerEdge Server portfolio offerings.
Splunk® Enterprise provides high-performance data analytics for organizations looking for operational, security and business intelligence. With Splunk Enterprise, organizations experience reduced downtime, gain continuous thread remediation and benefit from smarter production insights.
Organizations can experience even higher performance with Splunk Enterprise by selecting the latest Dell EMC™ PowerEdge™ servers. These servers are configured with 3rd Generation Intel® Xeon® Scalable processors and Intel® Ethernet 800 Series network adapters. 3rd Generation Intel® Xeon® Scalable processors deliver an average 46 percent improvement on popular data center workloads, compared to the previous generationi. Intel® Ethernet 800 Series network adapters for OCP3 can help reduce latency and increase application throughput.
Intel and Splunk have partnered to develop recommended configurations for Dell EMC PowerEdge servers. Below, you will find configurations for the Splunk Enterprise admin server, search head and index servers (for either 120-day or 365-day retention) at three performance levels: reference, mid-range and high- performance.
Key Considerations
Splunk users should configure their server infrastructures to match their data-analysis needs. For example, optimizing for low search runtimes requires a different approach than optimizing for high data-ingestion rates.
Before you start, know your use case. Will your Splunk workload ingest data and then index it to make it available for search? Or will your Splunk workload primarily search—that is, query and report? Alternatively, do you envision balancing workloads between ingesting data and searching through data? First characterize your workloads, and then tune your infrastructure as outlined in the following steps:
- Tune your infrastructure for indexing. If most of your workloads ingest and index data, consider increasing the number of parallel ingestion pipelines on the indexer or increasing DRAM capacity.
- Tune your infrastructure for search. If most of your workloads search, consider adding more search heads, adding more computing power on the indexers, or increasing DRAM capacity. For dense search requirements, you might want to turn off hyper-threading.
- Tune balanced workloads. If your workloads are balanced, add indexers when you need to scale.
Recommended Configurations
The recommended configurations for the Splunk Enterprise admin server, search head, and indexers are shown in the table below. Note the following configuration definitions: Reference configuration: Ingestion up to 200 GB per day.
Mid-range configuration: Ingestion up to 250 GB per day.
High-performance configuration: Ingestion up to 300 GB per day.
| Admin Server | Search Head | Indexer (120-day retention) | Indexer (365-day retention) |
Configurations | The admin server and search head have the same configurations for reference, mid- range, and high-performance configurations. | Indexer CPU components are color-coded to indicate configuration. Blue: Reference configuration Green: Mid-range configuration Orange: High-performance configuration | ||
Platform | Dell EMC™ PowerEdge™ R650 supporting 8 x 2.5” Serial- Attached SCSI (SAS)/Serial ATA (SATA) drives | Dell EMC PowerEdge R750 chassis supporting 24 x 2.5” SAS/SATA drives | Dell EMC PowerEdge R750 chassis supporting 24 x + 4 x (rear) 2.5” SAS/SATA drives | |
CPU | 2 x Intel® Xeon® Gold 6326 processor (16 cores at 2.9 GHz) | 2 x Intel® Xeon® Gold 6326 processor (16 cores at 2.9 GHz) | 2 x Intel® Xeon® Gold 6326 processor (16 cores at 2.9 GHz) 2 x Intel® Xeon® Gold 6354 processor (18 cores at 3.0 GHz) 2 x Intel® Xeon® Gold 6348 processor (28 cores at 2.6 GHz) | |
DRAM | 64 GB (8 x 8 GB DDR4- 3200) | 128 GB (8 x 16 GB DDR4-3200) | ||
Boot device | Dell EMC™ Boot Optimized Server Storage (BOSS)-S2 with 2 x 480 GB Intel® SSD S4510 M.2 SATA (RAID1) | |||
Storage adapter | Dell™ PowerEdge RAID Controller (PERC) H345 | Dell PERC H755 | Dell PERC H755 + expander | |
Storage | 2 x 960 GB Intel® SSD S4610 SATA (mixed-use) | 2x 480 GB Intel® SSD S4610 SATA (mixed-use) |
| |
Storage (hot/warm) |
| 6 x 960 GB Intel® SSD S4610 SATA (RAID6) (mixed-use) | ||
Storage (cold tier) | 8 x 2.4 TB 10K rotations per minute (RPM) SAS hard-disk drive (HDD) (RAID6) | 18 x + 4 x (rear) 2.4 TB 10k RPM SAS HDD (RAID6) | ||
Network interface card (NIC) | Intel® Ethernet Network Adapter E810-XXVDA2 for OCP3 (dual-port 25 Gb) |
Learn More
Contact your Dell or Intel account team for a customized quote 1-877-289-3355
Learn more about Dell EMC PowerEdge R750 and R650 servers.
Learn more about high-performance data analytics with Splunk Enterprise running on Intel technologies.
i Source: 125 at Intel. “3rd Generation Intel® Xeon® ® Scalable Processors – Performance Index.” www.intel.com/3gen-Xeon® - config. Results may vary.