Splunk Enterprise Security

Not to use RAID5 on SSD when using SmartStore.

rbal_splunk
Splunk Employee
Splunk Employee

Why avoid RAID5 on SSD when using SmartStore?

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The problem about RAID5/6 even with SSDs, and especially with SmartStore, is that you add at least two dimensions of access patterns and obviously a lot more linear write (download from SmartStore to the local cache) to the game.


A normal IDX does random read/write for ingesting and a lot more read while searching.


The upload of a rolled bucket will need another linear read of the bucket and a linear write if you download the bucket again.
So even more IO and remember that write IO will stress the RAID because you have to calc the checksums…
I think this was learning from our own tests with RAID in AWS.

Also, why waste space/iops on your cache, if you already have a copy in S3 (smart store for stable bucket) or on other hosts (RF for buckets that haven’t been uploaded)
 

 

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...