Deployment Architecture

Is the AMD Rome EPYC architecture a valid option now?

New Member

I've been poking around the interwebs trying to figure out if there is a benefit/downside to going with the new AMD Rome EPYC architecture for our Splunk servers.

I don't find anything specific. I "think" we would be good to go, but I was hoping for a more definitive answer.


Rich Hickey

0 Karma

Splunk Employee
Splunk Employee

I have a customer who has moved off Intel's Xeon to AMD's Epyc CPUs for their server hardware refresh. Currently their 3 node Search Head Cluster (SHC) sit on EPYC 7502P (32C/64T), 512GB of RAM, 2x 500GB RAID1 SSD servers. Indexers are being migrated to EPYC 7402P (24C/48T) 512GB of RAM, 2x 500GB RAID1 SSD (OS/Splunk), Intel 905P 960GB Optane AIC (hot/warm buckets) and some kind of all SSD storage array. In the end the indexers will go from 6 Intel Xeon-based ones to 4 Epyc Servers.

He noted the massive cost savings going to AMD was a no-brainer and will continue to completely discontinue the use of Intel Xeons in all of their data centers. As for performance, they are coming from 2016/2017 era Broadwell-based Xeons and so far the Epyc CPUs are crushing the Intel counterparts in both single threaded and multithreaded performance. The quote from his server vendor for the Core for Core pricing between Intel and AMD was almost 3.5x more expensive going with Intel.

He sent me this as a comparison of price/performance between Xeon and Epyc:

As a former IT Manager and Splunk customer, I would steer clear of Intel CPUs for pricing and security concerns.

For the OS, all are running CentOS 8 with the recommended Splunk Linux tuning provided in the docs.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...