Splunk index on isilon?

[melonman]

Hi,

Is there any hardware limitation for the storage to putting index on?
Is Isilon (as NFS) OK to use with Splunk?

Thanks in advance,

[araitz]

That's my question as well. As you said, Splunk does many small, fast, often random iops.

[melonman]

Around me Isilon is mainly used for media/video file storage server, and Isilon provides very good performance. I was wondering if Splunk, which mainly does small and fast I/O operations, would be also on isilon to get good performance.

[peglarr · Accepted solution]

Splunk absolutely works with Isilon...and as for speed, the scale-out nature of Isilon provides much faster performance than most NAS implementations. NFS v3/v4, SMB v1/v2, dual 10GE per node, if you are familiar with Isilon already you know this.

[araitz]

Good to know, thanks! Do you have customers using Isilon for Splunk today?

[araitz]

Splunk supports most NFS implementations, though I am not familiar with Isilon in particular. See: http://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements#Supported_file_sy...

The easiest way to check if the file system will work is to do the following on a test system:

export $SPLUNK_DB=/path/to/your/filesystem
splunk cmd locktest

Please note that most NFS implementations will not offer performance as good as fast local storage. Since Splunk scales horizontally (by adding more commodity servers), this is the approach we most often recommend.