Deployment Architecture

Any reason why Splunk couldn't use something like gluster as a storage option?

Splunk Employee
Splunk Employee

Has anyone had any experience with clustered storage like gluster?

Tags (2)
0 Karma


While researching my zfs problem, I stumbled over this:
It seems that this does the trick:
echo OPTIMISTIC_ABOUT_FILE_LOCKING = 1 >> /opt/splunk/etc/splunk-launch.conf

0 Karma


I'm still in my initial testing, but gluster works if you mount the glusterfs via nfs locally. This isn't exactly ideal but seems to work better than straight NFS if you have good network connectivity and fast local storage. I've tested with both splunk 4.3 and 5.0.1. performance in 5.0.1 is comparable to standalone search heads.

0 Karma


I couldn't get search head pooling to work with gluster 3.2.5 😞

Error in search head pooling enable: Failed to lock /mnt/splunk/etc/etc/users/testpath with return code -1: File exists

I logged a call with Splunk support and they confirmed that it is not supported... feature request submitted.

I'm going to use DRBD in the meantime, but gluster would have been way better!

Luke 🙂

0 Karma

Super Champion

Does it pass according to the locktest utility?

Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...