Deployment Architecture

Any reason why Splunk couldn't use something like gluster as a storage option?

Splunk Employee
Splunk Employee

Has anyone had any experience with clustered storage like gluster?

Tags (2)
0 Karma


While researching my zfs problem, I stumbled over this:
It seems that this does the trick:
echo OPTIMISTIC_ABOUT_FILE_LOCKING = 1 >> /opt/splunk/etc/splunk-launch.conf

0 Karma


I'm still in my initial testing, but gluster works if you mount the glusterfs via nfs locally. This isn't exactly ideal but seems to work better than straight NFS if you have good network connectivity and fast local storage. I've tested with both splunk 4.3 and 5.0.1. performance in 5.0.1 is comparable to standalone search heads.

0 Karma


I couldn't get search head pooling to work with gluster 3.2.5 😞

Error in search head pooling enable: Failed to lock /mnt/splunk/etc/etc/users/testpath with return code -1: File exists

I logged a call with Splunk support and they confirmed that it is not supported... feature request submitted.

I'm going to use DRBD in the meantime, but gluster would have been way better!

Luke 🙂

0 Karma

Super Champion

Does it pass according to the locktest utility?

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...