What type of storage is needed for frozen data?

[ankithreddy777]

Until now our clustered indexers do not have the frozen Directory.
Now we would like to add the storage especially to data that is going to be frozen.

So what type of storage is required? Can we use SAN storage that is shared by all Indexers to store frozen data at one place? Otherwise do I need to use local storage for each Indexer to hold frozen Data?

[aaraneta_splunk]

@ankithreddy777 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

[cmeo]

You can customise what happens with frozen buckets as documented here:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Automatearchiving
Thus you can use any type of storage at all, and control how your stuff gets there, as long your indexer can get to it somehow.

[nickhills]

Normally LUNS from a SAN are mounted on one system at a time, and unless you have a system which specifically supports multi mounting, bad things can occur.

NAS, however, is althogether different and is an ideal way to mount the same fileshare on multipul systems. Once mounted you can simply point your frozen dir to the NAS mountpoint and create a directory for each index.