Which type of storage is suitable of Splunk

[Somesh]

Can someone suggest which type of storage is best for Splunk Cluster ? Is it Block storage or Object Storage.

[isoutamo]

Hi

this depends on your use case and where and how you have installed Splunk. In on premise in most cases block storage is the best/only suitable solution. You haven’t enough good (fast+bandwith) storage network + storage for object storage.

But in cloud e.g. AWS you could use object storage (S3) if/when you could build your environment with enough big local cache (NVMe). Basically most of your requests must hit into cache and then it works, but if too many requests goes to S3 then you suffer bad response time and user experience.

r. Ismo

[Somesh]

Hello @richgalloway ,

Could you please tell me why Block storage over Object Storage ?

[richgalloway]

Splunk requires a hierarchical file system.  You can, however, move your frozen data to an object store, if you wish.

[richgalloway]

Block storage