Splunk Enterprise

Index filesystem sizing

mfrost8
Builder

We're building out new Linux Splunk servers on dedicated hardware. These servers have a rather large amount of disk space available (over 2Tb) running on RAID10. They're both going to be indexers with events auto-load balanced between them.

We're debating about how we want to allocate that for index space. Is there any particular reason why we would not want to create a 1TB or 1.5 TB or even 2 TB filesystem? As opposed to say, creating multiple smaller filesystems?

We currently have no requirements for particular indexes so right now everything's just going to go into the same big pot.

Thanks

Tags (1)
1 Solution

southeringtonp
Motivator

It's much simpler to keep all of your indexes on one volume unless you have a reason not to.

Your best bet is probably to carve off one or more volumes for the operating system, then allocate the majority of the space as single, dedicated volume to contain all of your Splunk indexes.

Splunk 4.2 may change things, but right now keeping everything together avoids a lot of tuning considerations. See the following for more information:
     http://answers.splunk.com/questions/8730/how-to-manage-the-size-of-my-indexes-to-fit-in-my-volumes

You've probably already found this, but you might also want to look over the information here:
     http://www.splunk.com/base/Documentation/latest/admin/HowSplunkstoresindexes

View solution in original post

southeringtonp
Motivator

It's much simpler to keep all of your indexes on one volume unless you have a reason not to.

Your best bet is probably to carve off one or more volumes for the operating system, then allocate the majority of the space as single, dedicated volume to contain all of your Splunk indexes.

Splunk 4.2 may change things, but right now keeping everything together avoids a lot of tuning considerations. See the following for more information:
     http://answers.splunk.com/questions/8730/how-to-manage-the-size-of-my-indexes-to-fit-in-my-volumes

You've probably already found this, but you might also want to look over the information here:
     http://www.splunk.com/base/Documentation/latest/admin/HowSplunkstoresindexes

mfrost8
Builder

Thanks. That's what I suspected.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...