topic Re: Volume partitioning and smartstore in Installation

Volume partitioning and smartstore

pBear — Tue, 05 Oct 2021 22:38:38 GMT

We are running a single Splunk Enterprise 8.1 instance on a Linux AWS EC2 instance. We are using smartstore backed by S3. We have /opt/splunk (including the index volume/cache) on a separate partition from the OS.

I have not seen/found any documentation addressing OS level partitioning.

Are there performance concerns with our current configuration? Would/could a spike in the size of non-index files on the splunk partition cause performance issues or caching abnormalities with smartstore?

Does it make sense to separate the indexes (./lib/) onto its own partition, separate from both the OS and splunk config/app/log and other transient files?

Re: Volume partitioning and smartstore

richgalloway — Wed, 06 Oct 2021 13:27:11 GMT

Yes! $SPLUNK_HOME, $SPLUNK_DB, and the OS should be on separate partitions.

Re: Volume partitioning and smartstore

pBear — Tue, 23 Nov 2021 22:15:28 GMT

Thank you.
It is as I expected. It makes perfect sense to me, regardless of smart-store or not. But I couldn't find any documentation I could point to in order to justify the architectural change to management.

I guess they are just going to have to take our word for it. 🙂