topic Re: Use NAS as cold storage in Getting Data In

Use NAS as cold storage

Nawab — Wed, 26 Jun 2024 09:50:10 GMT

We are using a clustered index environment and want to use NAS as our cold storage.

I mapped NAS to a local folder for linux to be accessable by splunk.

I can see the folders to be mapped on local linux device.

But when i change the configuration on cluster master to use this nas as cold data and push the configuration, splunk some time hang up and stops, even if i restart it it would not work.

Has anyone tried nas as cold storage and can share his fstab and indexex.conf that would be great!

Re: Use NAS as cold storage

marnall — Mon, 22 Jul 2024 19:23:02 GMT

Are you sure that the NAS is fast enough to receive and write the logs of your Splunk cluster? You need a lot of bandwidth and IOPS, especially if the NAS is being used by multiple indexers at the same time.

Re: Use NAS as cold storage

Nawab — Tue, 23 Jul 2024 07:10:12 GMT

Hi Manall,

I want to use NAS as read storage i.e as cold not hot.
BTW its work fine with me till now