Deployment Architecture

What type of storage is needed for frozen data?

ankithreddy777
Contributor

Until now our clustered indexers do not have the frozen Directory.
Now we would like to add the storage especially to data that is going to be frozen.

So what type of storage is required? Can we use SAN storage that is shared by all Indexers to store frozen data at one place? Otherwise do I need to use local storage for each Indexer to hold frozen Data?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@ankithreddy777 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

cmeo
Contributor

You can customise what happens with frozen buckets as documented here:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Automatearchiving
Thus you can use any type of storage at all, and control how your stuff gets there, as long your indexer can get to it somehow.

0 Karma

nickhills
Ultra Champion

Normally LUNS from a SAN are mounted on one system at a time, and unless you have a system which specifically supports multi mounting, bad things can occur.

NAS, however, is althogether different and is an ideal way to mount the same fileshare on multipul systems. Once mounted you can simply point your frozen dir to the NAS mountpoint and create a directory for each index.

If my comment helps, please give it a thumbs up!