If I cluster do I need RAID?

[robertlynch2020]

Hi

we are about to move from single install to cluster Install on 3 machines (1 search head and 3 indexers) and we are getting SSD.

As SSD is expensive, do we need to add on RAID as well?

Thanks in Advance
Rob

[robertlynch2020]

Hi

Thanks for this, so we are looking to go for RAID 5 on SSD.

So after reading the document i get the feeling SSD vs. SAN

Write: Is the same
Read sequential: Is the same
Read Sparc: Is much better

Most of our data is in datamodels, so i am not sure if that also make a difference?
At the moment the current install is on SSD, so i am a bit nervous from moving back to SAN!

Thanks
Robert

[gcusello · Accepted solution]

Hi @robertlynch2020,
at first to have an Indexer Cluster you need also an additional server called Master Node that manages cluster and cannot be neither Search Head or Indexer.

About SSD you should read https://www.splunk.com/en_us/blog/tips-and-tricks/quantifying-the-benefits-of-splunk-with-ssds.html and https://docs.splunk.com/Documentation/Splunk/8.0.2/Capacity/Referencehardware .
Sequential write performance on SSD vs SAS is pretty similar so no real benefit for Splunk on an SSD here.

Anyway I didn't see any Splunk installation without RAID0 on system disks and RAID1+0 on data disks.
Eventually you could think to have fast disks for hot and warm buckets and slower disks for cold buckets.

Ciao.
Giuseppe

[gcusello]

Never RAID 5 because is slower than RAID1+0!
Ciao.
Giuseppe

[robertlynch2020]

Hi

Thanks for the info, at the moment Splunk is on RAID 5 and the performance is good, but i will hopefully be able to take your advice for the future.

Rob