How to configure our cluster using NFS as storage?

[jitendrasingh12]

Hi We are using a 2 Peer (indexer) configuration for Splunk

We are having two search heads two indexers that are in cluster with a deployment server as master .

Now we are using NFS as storage for storing data . We are not using the shared storage for now . We have given NFS mount points of 2 TB to each indexers now question that we have are

1) how we can configure the splunk infrastructure to work with NFS mount points on each indexers
2) How we will decide or monitor the ownership of indexed data .
3) How will replication work in this case
4) What is the recommendations in this case .

[hsesterhenn]

Hi, I am afraid you won't like this answer...

Question: How much data is indexed/day? How many concurrent users on the SearchHeads, what are the use cases?

Using NFS for hot/warm storage won't work for most of the NFS implementations.
Using NFS for cold storage (longtime storage) would work.

Take a look here:
http://answers.splunk.com/answers/250/can-splunk-read-data-to-index-off-an-nfs-mount-can-splunk-stor...

Splunk Enterprise needs high speed disk storage to index data.
http://docs.splunk.com/Documentation/Splunk/6.1.4/Deploy/HardwarecapacityplanningforadistributedSplu...
http://docs.splunk.com/Documentation/Splunk/6.1.4/Installation/CapacityplanningforalargerSplunkdeplo...

For more details on IOPS see here:
http://answers.splunk.com/answers/84340/how-many-iops-can-i-expect-from-a-disk.html

HTH,

Holger