Will Splunk work with RedHat Ceph?

[a212830]

Has anyone tried to use Splunk with RH Ceph? Cold storage? Does Splunk plan on support it in the future?

[esix_splunk · Accepted solution]

CEPH is currently not supported. However.. if you read here : https://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Indexesconf

The latest version can use s3 / nfs mounts.. CEPH might work... But, again, its not officially supported....

[MATTDGAIR]

We are testing SoftIron.com Ceph at a major Splunk shop in Texas now. We'll relay the results here.
Matt.Gair@softiron.com

[mathieuamos]

Any change or update on this? Had a customer ask me today about it, and this is the most recent thing I see. Thanks!

[sloshburch]

You're welcome to peek at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf to see if the features @esix highlighted become supported (vs experimental) although keep in mind that the Splunk Enterprise software has more general storage requirements that may be satisfied by unlisted storage formats. That list (should it update) are at http://docs.splunk.com/Documentation/Splunk/latest/Capacity/Referencehardware#Disk_subsystem

[sloshburch]

Hey @esix, am I reading correctly that the s3 / nfs is only for virtual indexes? If so, then is it fair to qualify this a bit by saying that the latest version can use s3 / nfs mounts when working with virtual indexes only?

[a212830]

Thanks.