VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK · VASTDATA.COM Vast Data COLD.FLASH Architecture For...

2
1 VASTDATA.COM Vast Data COLD.FLASH Architecture For Splunk VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK VAST UNIVERSAL STORAGE DELIVERS SUPERIOR VALUE FOR SPLUNK ENVIRONMENTS IT infrastructure generates massive streams of machine data every day, and thousands of organizations are deploying Splunk Enterprise to analyze their machine data in order to gain valuable operational intelligence. However, the deployment and optimization of Splunk presents complex storage sizing challenges. How much flash-based storage do you allocate for the Hot/Warm buckets? Bad decisions coupled with unpredictable future search requirements can result in poor cluster performance, inefficiencies and reduced insights. Splunk’s storage tiering exists for only one reason – optimizing storage costs. If storage costs weren’t an issue, flash would resolve this tradeoff. The VAST Data COLD.FLASH architecture takes the guess work out of Splunk storage sizing by significantly reducing the SSD capacity (up to 70%) within each Index server (1 day of Hot/Warm) and utilizes VAST Universal Storage to provide the scalable all-flash cold buckets to accelerate search performance, regardless of the data volume. The VAST All-Flash shared storage cluster combines QLC Flash, low-overhead next generation erasure codes and global data reduction (Splunk=3.6:1) to enable a lower total cost of Splunk storage acquisition without the limits of slow buckets. HOT PERFORMANCE. COLD ECONOMICS. NO FEATURE COMPROMISE. ALL-FLASH, HOT PERFORMANCE Sub-millisecond read latency for all Splunk data 100% SUPPORTED CONFIGURATION A Small Amount SSDs or Optane for Hot/Warm buckets, VAST NFS for cold buckets COLD ECONOMICS 60% less expensive than tiered DAS storage NO SMARTSTORE COMPLICATIONS Cold Buckets are better for long-term, replicated search EXABYTE-SCALE Scale Splunk to support any retention period IDEAL FOR SPLUNK SERVICEABILITY Minimizing the DAS footprint makes it easy and fast to upgrade Splunk clusters HOT PERFORMANCE, COLD ECONOMICS

Transcript of VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK · VASTDATA.COM Vast Data COLD.FLASH Architecture For...

Page 1: VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK · VASTDATA.COM Vast Data COLD.FLASH Architecture For Splunk 1 VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK VAST UNIVERSAL STORAGE DELIVERS

1V A S T D A T A . C O M Vast Data COLD.FLASH Architecture For Splunk

VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK

V A S T U N I V E R S A L S T O R A G E D E L I V E R S S U P E R I O R V A L U E F O R S P L U N K E N V I R O N M E N T S

IT infrastructure generates massive streams of machine data every day, and

thousands of organizations are deploying Splunk Enterprise to analyze their

machine data in order to gain valuable operational intelligence. However,

the deployment and optimization of Splunk presents complex storage

sizing challenges. How much flash-based storage do you allocate for the

Hot/Warm buckets? Bad decisions coupled with unpredictable future

search requirements can result in poor cluster performance, inefficiencies

and reduced insights. Splunk’s storage tiering exists for only one reason

– optimizing storage costs. If storage costs weren’t an issue, flash would

resolve this tradeoff.

The VAST Data COLD.FLASH architecture takes the guess work out of

Splunk storage sizing by significantly reducing the SSD capacity (up to 70%)

within each Index server (1 day of Hot/Warm) and utilizes VAST Universal

Storage to provide the scalable all-flash cold buckets to accelerate search

performance, regardless of the data volume. The VAST All-Flash shared

storage cluster combines QLC Flash, low-overhead next generation erasure

codes and global data reduction (Splunk=3.6:1) to enable a lower total cost

of Splunk storage acquisition without the limits of slow buckets.

HOT PERFORMANCE.

COLD ECONOMICS.

NO FEATURE COMPROMISE.

ALL-FLASH, HOT PERFORMANCE

Sub-millisecond read

latency for all Splunk data

100% SUPPORTED CONFIGURATION

A Small Amount SSDs or

Optane for Hot/Warm buckets,

VAST NFS for cold buckets

COLD ECONOMICS

60% less expensive than

tiered DAS storage

NO SMARTSTORE COMPLICATIONS

Cold Buckets are better

for long-term, replicated

search

EXABYTE-SCALE

Scale Splunk to support

any retention period

IDEAL FOR SPLUNK SERVICEABILITY

Minimizing the DAS footprint

makes it easy and fast to

upgrade Splunk clusters

HOT PERFORMANCE, COLD ECONOMICS

Page 2: VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK · VASTDATA.COM Vast Data COLD.FLASH Architecture For Splunk 1 VAST DATA COLD.FLASH ARCHITECTURE FOR SPLUNK VAST UNIVERSAL STORAGE DELIVERS

2V A S T D A T A . C O M © 2020 VAST Data, Inc. All rights reserved. All trademarks belong to their respective owners.

VAST_Data-Splunk_03062020

E L I M I N A T E T I E R S W I T H U N I V E R S A L S T O R A G E

Never move data between buckets. Get up to 30X better performance.

To learn more about how unconventional thinking can solve decades of

tradeoffs, contact us today.

THE LOWEST COST ALL-FLASH

Saves 60%+

ERASURE CODES WITH ONLY 3% OVERHEAD

Saves another 25%+

CLASSIC SPLUNK INDEXER CLUSTER

DAS, SAN, NAS

SMARTSTORE INDEXER CLUSTER

Tiered

Smartstore Cache

SHARED EVERYTHING INDEXER CLUSTER

Single Tier

230TBSTORAGE NEEDED

7INDEXERS NEEDED

18RACK UNITS NEEDED

105TBSTORAGE NEEDED

5INDEXERS NEEDED

15RACK UNITS NEEDED

400TBSTORAGE NEEDED

19INDEXERS NEEDED

38RACK UNITS NEEDED

+ + =NEW GLOBAL

COMPRESSION

Saves another 50%+

STORAGE REVOLUTION

60% less than DAS

V A S T I N N O V A T I O N D E L I V E R S D R A M A T I C S P L U N K S A V I N G S


Splunk user group - automating Splunk with Ansible

Splunk user group - automating Splunk with Ansible

Behind the Magnifying Glass€¦ · jchampagne@splunk.com Started with Splunk in the fall of 2014 Member of the Splunk Architecture Council Former Splunk customer in the Financial

Behind the Magnifying Glass€¦ · [email protected] Started with Splunk in the fall of 2014 Member of the Splunk Architecture Council Former Splunk customer in the Financial

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

TR-4260: NetApp Architecture for Splunkstatic.ziftsolutions.com/files/8a16c27a4e0e96df014e1c4760e85e56.pdf · Technical Report NetApp Architecture for Splunk Walter Schroeder, Matt

TR-4260: NetApp Architecture for Splunkstatic.ziftsolutions.com/files/8a16c27a4e0e96df014e1c4760e85e56.pdf · Technical Report NetApp Architecture for Splunk Walter Schroeder, Matt

Splunk Architecture overview

Splunk Architecture overview

TR-4260: NetApp Architecture for Splunk · Technical Report NetApp Architecture for Splunk Walter Schroeder, Matt Hurford, Daniel Chan Field Center of Innovation, NetApp Brett Matthews,

TR-4260: NetApp Architecture for Splunk · Technical Report NetApp Architecture for Splunk Walter Schroeder, Matt Hurford, Daniel Chan Field Center of Innovation, NetApp Brett Matthews,

Support your digital transformation journey with Splunk & Dell … · 2019-12-06 · Splunk Architecture Send data from thousands of servers using any combination of Splunk Forwarders

Support your digital transformation journey with Splunk & Dell … · 2019-12-06 · Splunk Architecture Send data from thousands of servers using any combination of Splunk Forwarders

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

FireEye and Splunk: Intro to Integration · FireEye and Splunk: Intro to Integration . ... This architecture has become a possibility in the 7.1 version of the FireEye CMS. ... Ex:

FireEye and Splunk: Intro to Integration · FireEye and Splunk: Intro to Integration . ... This architecture has become a possibility in the 7.1 version of the FireEye CMS. ... Ex:

Splunk Architecture Workshop - Aplura€¦ · Who Are You? You Know Splunk is Right for You You Know Key Splunk Concepts You Require Purpose-Built Architecture You Have Scale Big

Splunk Architecture Workshop - Aplura€¦ · Who Are You? You Know Splunk is Right for You You Know Key Splunk Concepts You Require Purpose-Built Architecture You Have Scale Big

Splunk Architecture Guide - cStor...index of all the machine data generated by all systems and infrastructure, Splunk enables users to ask any question and find answers quickly to

Splunk Architecture Guide - cStor...index of all the machine data generated by all systems and infrastructure, Splunk enables users to ask any question and find answers quickly to

Splunk conf2014 - Onboarding Data Into Splunk

Splunk conf2014 - Onboarding Data Into Splunk

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad itinnovation@contacts.bham.ac.uk Indexing 2.2.1 Searching using splunk Splunk uses

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

AboutUs* - SplunkConf · AboutUs* Splunk*Architecture*@BoschMSI SplunkinBosch IoTBusiness Splunk*Monitoring*@BoschMSI 1 2 3 4 5 Pastand*Future*Challenges* BoschSoware&Innovaons Agenda

AboutUs* - SplunkConf · AboutUs* Splunk*Architecture*@BoschMSI SplunkinBosch IoTBusiness Splunk*Monitoring*@BoschMSI 1 2 3 4 5 Pastand*Future*Challenges* BoschSoware&Innovaons Agenda

Splunk Architecture Workshop · Splunk migrations are easily done You can do almost anything without data loss … and minimal downtime But, this is your data. This is valuable Understand

Splunk Architecture Workshop · Splunk migrations are easily done You can do almost anything without data loss … and minimal downtime But, this is your data. This is valuable Understand

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

Using Splunk Enterprise with VxRail Appliances and … › ... › h15699-splunk-vxrail-sg.pdfSplunk Enterprise on VxRail Appliance reference architecture Figure 2 shows a reference

Using Splunk Enterprise with VxRail Appliances and … › ... › h15699-splunk-vxrail-sg.pdfSplunk Enterprise on VxRail Appliance reference architecture Figure 2 shows a reference

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active