Deployment Architecture

Index cluster with multiple partitions

Explorer

Im looking to take advantage of faster disks for specific index's. Would there be any issues if I setup my index cluster with two separate hot storage partitions?

For example I want index "A" homePath =/mnt/disk1/splunkdb and index "B" homePath =/mnt/disk2/splunkdb

0 Karma
1 Solution

Motivator

That should be perfectly fine. Might get a bit confusing in the indexes.conf depending on how many indexes you have setup. I might do something like this in the indexes.conf to make it easier to read and follow:

# Volume definitions

[volume:primary]
path = /opt/splunk/var/lib/splunk

[volume:hot]
path = /mnt/disk1/splunkdb

[volume:flash]
path = /mnt/disk2/splunkdb

# Indexes List

[index1]
maxDataSize = auto
maxHotBuckets = 3
homePath.maxDataSizeMB = 10000
homePath   = volume:hot/index1/db
coldPath   = volume:primary/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb
repFactor = auto
rotatePeriodInSecs=600

[index2]
maxDataSize = auto_high_volume
maxHotBuckets = 10
homePath.maxDataSizeMB = 500000
homePath   = volume:flash/index2/db
coldPath   = volume:primary/index2/colddb
thawedPath = $SPLUNK_DB/index2/thaweddb
repFactor = auto
rotatePeriodInSecs=600

View solution in original post

Motivator

That should be perfectly fine. Might get a bit confusing in the indexes.conf depending on how many indexes you have setup. I might do something like this in the indexes.conf to make it easier to read and follow:

# Volume definitions

[volume:primary]
path = /opt/splunk/var/lib/splunk

[volume:hot]
path = /mnt/disk1/splunkdb

[volume:flash]
path = /mnt/disk2/splunkdb

# Indexes List

[index1]
maxDataSize = auto
maxHotBuckets = 3
homePath.maxDataSizeMB = 10000
homePath   = volume:hot/index1/db
coldPath   = volume:primary/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb
repFactor = auto
rotatePeriodInSecs=600

[index2]
maxDataSize = auto_high_volume
maxHotBuckets = 10
homePath.maxDataSizeMB = 500000
homePath   = volume:flash/index2/db
coldPath   = volume:primary/index2/colddb
thawedPath = $SPLUNK_DB/index2/thaweddb
repFactor = auto
rotatePeriodInSecs=600

View solution in original post

SplunkTrust
SplunkTrust

Hi mike,

I don't see any problem in that. Splunk should handle this smoothly and without any errors.