Monitoring Splunk

Are LUN sizes a factor when planning SAN storage for Splunk?

Mick
Splunk Employee
Splunk Employee

Under Windows 2008 64 bit what is the optimal LUN size on a SAN for SPLUNK. We plan to have 1.5 TB total storage to start. Would 140GB LUNs be more efficient than smaller ones?

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

On any individual Splunk instance can only use two LUNs, per index, one for hot/warm and one for cold. An exception is if you use software RAID on the server, but that's uncommon in Windows.

We'd recommend 1-10 TB/data per LUN, so larger ones are preferred.

View solution in original post

Mick
Splunk Employee
Splunk Employee

Using RAID 5 on hot & warm DB storage volumes is not recommended. It will significantly reduce the speed of both indexing and searching.

The recommended RAID solution is 10, along with the fastest disks you can buy, 10-15K RPM if available.

In this example, I don't think the size and number of disks will be a big issue, as the performance capacity will be determined by the capabilities of the hardware used. In most cases, this will likely hold true - the size of your disk isn't really the issue, its how fast you can write to and read from it

For further info on this subject, take a look at this answer

0 Karma

Dan
Splunk Employee
Splunk Employee

For SATA drives, is it better to have more smaller drives or fewer larger drives? I have the option of 24 x 146GB drives or 12 x 300GB drives. The RAID controller will be a PERC H800 in RAID 5.

0 Karma

Mick
Splunk Employee
Splunk Employee

Using RAID 5 on hot & warm DB storage volumes is not recommended. It will significantly reduce the speed of both indexing and searching.

The recommended RAID solution is 10, along with the fastest disks you can buy, 10-15K RPM if available.

In this example, I don't think the size and number of disks will be a big issue, as the performance capacity will be determined by the capabilities of the hardware used. In most cases, this will likely hold true - the size of your disk isn't really the issue, its how fast you can write to and read from it.

Stephen_Sorkin
Splunk Employee
Splunk Employee

On any individual Splunk instance can only use two LUNs, per index, one for hot/warm and one for cold. An exception is if you use software RAID on the server, but that's uncommon in Windows.

We'd recommend 1-10 TB/data per LUN, so larger ones are preferred.

gkanapathy
Splunk Employee
Splunk Employee

Just to clarify, here "LUN" is used to mean "filesystem" or "logical volume" at the OS level. In some usage, multiple storage-level LUNs can be combined by a Logical Volume Manager into a single OS volume.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...