Monitoring Splunk

Raid 6, setting up for performance issues?

xxyz
Explorer

Deploying new indexers and trying maximize the storage we have. Raid 6 was configured on 15K SAS drives for Hot/Warm buckets and Raid 6 on 10K SAS drives for Cold Buckets. We average around just under 250 GB of data / day. I keep reading to have Hot/Warm on Raid 10. So am I setting myself up for performance issues here?

Tags (3)

alacercogitatus
SplunkTrust
SplunkTrust

Supposing, I wonder, whereby I found my self lost, that my internal dialogue was in fact a configuration 6 of Raid. I thusly found myself feeling ill, as I had lost parity of my own thoughts, and slowly began to rebuild my nervous system of coherent thought. For while my thoughts worked correctly, I feel fine. At the mere mention of an unstable coaxial connection, I immediately began to slow and consume more resources to rebuild myself. I couldn't keep up with both the sensory input and the internal rebuild. I began to backlog until I crashed. Upon waking, I found myself in a corrupted state, even more so than most politicians. Wearily I tell you, begin your life in the 1+0 of Raid, and happier shall you be.

jbernt_splunk
Splunk Employee
Splunk Employee

If you can do Raid 10 instead for hot/warm buckets, that would be best.

jtrucks
Splunk Employee
Splunk Employee

Yes, you are setting yourself up for potential performance problems at that ingest rate.

--
Jesse Trucks
Minister of Magic

Richfez
SplunkTrust
SplunkTrust

Yes. It's very likely.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...