Is anyone utilizing deduplication at the storage level (SAN) for Splunk data and how does it perform?

[dustyblahblah]

Is anyone utilizing deduplication on storage arrays for Splunk volumes, and how does it perform?

[my2ndhead]

What is your goal?

You will benefit from space savings only for replicated buckets (index replication).

The buckets themselves, as they are already compressed with gzip, will not-dedup very well, if at all.

[dustyblahblah]

No real goal in mind, just a curiosity. Our environment will be growing soon, so the R5 LUN (very low search usage, so R10 was not needed) will need to be changed to R10. With change in storage, we have option to move system and utilize a NetApp device with Dedupe. I am just looking at options. It seems like this is not one.

[thomrs]

We have dedup on our Netapp and no issues, my storage guy is happy with the space saved.

Note this is for our cold storage. For hot/warm you want pure speed, I use a local raid 10 array there.