Are LUN sizes a factor when planning SAN storage for Splunk?

[Mick]

Under Windows 2008 64 bit what is the optimal LUN size on a SAN for SPLUNK. We plan to have 1.5 TB total storage to start. Would 140GB LUNs be more efficient than smaller ones?

[Mick]

Using RAID 5 on hot & warm DB storage volumes is not recommended. It will significantly reduce the speed of both indexing and searching.

The recommended RAID solution is 10, along with the fastest disks you can buy, 10-15K RPM if available.

In this example, I don't think the size and number of disks will be a big issue, as the performance capacity will be determined by the capabilities of the hardware used. In most cases, this will likely hold true - the size of your disk isn't really the issue, its how fast you can write to and read from it

For further info on this subject, take a look at this answer

[Dan]

For SATA drives, is it better to have more smaller drives or fewer larger drives? I have the option of 24 x 146GB drives or 12 x 300GB drives. The RAID controller will be a PERC H800 in RAID 5.

[Mick]

Using RAID 5 on hot & warm DB storage volumes is not recommended. It will significantly reduce the speed of both indexing and searching.

The recommended RAID solution is 10, along with the fastest disks you can buy, 10-15K RPM if available.

In this example, I don't think the size and number of disks will be a big issue, as the performance capacity will be determined by the capabilities of the hardware used. In most cases, this will likely hold true - the size of your disk isn't really the issue, its how fast you can write to and read from it.

[Stephen_Sorkin · Accepted solution]

On any individual Splunk instance can only use two LUNs, per index, one for hot/warm and one for cold. An exception is if you use software RAID on the server, but that's uncommon in Windows.

We'd recommend 1-10 TB/data per LUN, so larger ones are preferred.

[gkanapathy]

Just to clarify, here "LUN" is used to mean "filesystem" or "logical volume" at the OS level. In some usage, multiple storage-level LUNs can be combined by a Logical Volume Manager into a single OS volume.