Installation

SQL Server dedicated for Splunk

eantonio
Path Finder

Does Splunk need a dedicated SQL Server to manage the data? Can the SQL Database be in the same server as Splunk instance is installed?

1 Solution

Damien_Dallimor
Ultra Champion

Splunk does not use a Relational Database to store and manage its data.
It uses flat files on the file system called "Indexes".

http://docs.splunk.com/Documentation/Splunk/latest/Admin/WhatsaSplunkindex

View solution in original post

rajbahak
Path Finder

Hello,

What if we want to host the splunk data on a SQL database? Is it possible to do that?

If so, does Splunk support sql databases that are hosted centrally on a SAN?

Thanks

0 Karma

gekoner
Communicator

You can, but be sure your device and connection meets the minimum IOPS. Otherwise your instance will have many problems.

0 Karma

rajbahak
Path Finder

thanks for your reply. That really helps. You mentioned we could store the index files just about anywhere, but I read in the admin guide and splunk doesn't recommend using mapped network drives.

We should be able to use mounted volumes off a SAN correct?

Thanks again

0 Karma

rtadams89
Contributor

No. Splunk cannot use any sort of external/3rd party database for storing the indexed data. However, you can store the index files Splunk uses just about anywhere.

Damien_Dallimor
Ultra Champion

Splunk does not use a Relational Database to store and manage its data.
It uses flat files on the file system called "Indexes".

http://docs.splunk.com/Documentation/Splunk/latest/Admin/WhatsaSplunkindex

rataide
Path Finder

You can find some sizing guidelines at http://www.splunk.com/wiki/Community:HardwareTuningFactors

0 Karma

Ayn
Legend

All correct. Well what type of config like RAID you use is up to you, but yes, all you need is a host with disk space.

0 Karma

eantonio
Path Finder

To clarify, Splunk does not use a SQL database to store and manage the data? If I were to build a Splunk server, I just need to make sure I have a Raid 10 config and make sure the hard drive space is big enough to hold all incoming data, and then install Splunk in that server?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

And to clarify, Splunk is the data server (among other things), so no additional server is required

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...