Deployment Architecture

Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers?


I am planning to deploy a Splunk Distributed Search Architecture in a mixed environment of 500 servers mostly Windows and some Red Hat Enterprise (RHEL) Linux 7. Splunk hosts will be RHEL 7.2 I will have two search heads: Enterprise & Security, a 3 node indexer clustered on the Splunk application level, and a separate Deployment Server.

I read that Splunk will create the necessary directories during installation. Is there partition model recommendation or LVM I should have ready before installing Splunk 6.4 in my Linux servers? Or should I just let Splunk create directories automatically during install?

See my current Linux partitions below:

/root           50G
/home/  200 G
/boot    500mb
/swap/   8G

Ultra Champion

You probably should let Splunk install itself under /opt/splunk and let it create its directories.

Special attention is usually needed for the indexer's file system. Usually, we would point it to a distinct file system such as /SplunkIndexData with high capacity based on your needs.

Splunk Employee
Splunk Employee

Go with whatever your sysadmins are used to, except put /opt/splunk on its own partition if and only if that makes backups or recovery easier for you.

On an indexer, I suggest making sure your index location (either /opt/splunk/var/lib/splunk/, or /data/, or whatever) its own partition, too.

As for directories, just let Splunk do it. The only thing you may need to do by hand is the index location on the indexers, if not using the default.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...