Deployment Architecture

Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers?


I am planning to deploy a Splunk Distributed Search Architecture in a mixed environment of 500 servers mostly Windows and some Red Hat Enterprise (RHEL) Linux 7. Splunk hosts will be RHEL 7.2 I will have two search heads: Enterprise & Security, a 3 node indexer clustered on the Splunk application level, and a separate Deployment Server.

I read that Splunk will create the necessary directories during installation. Is there partition model recommendation or LVM I should have ready before installing Splunk 6.4 in my Linux servers? Or should I just let Splunk create directories automatically during install?

See my current Linux partitions below:

/root           50G
/home/  200 G
/boot    500mb
/swap/   8G

Ultra Champion

You probably should let Splunk install itself under /opt/splunk and let it create its directories.

Special attention is usually needed for the indexer's file system. Usually, we would point it to a distinct file system such as /SplunkIndexData with high capacity based on your needs.

Splunk Employee
Splunk Employee

Go with whatever your sysadmins are used to, except put /opt/splunk on its own partition if and only if that makes backups or recovery easier for you.

On an indexer, I suggest making sure your index location (either /opt/splunk/var/lib/splunk/, or /data/, or whatever) its own partition, too.

As for directories, just let Splunk do it. The only thing you may need to do by hand is the index location on the indexers, if not using the default.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...