Configuring volumes for Splunk indexers could not be any simpler: due to the unique capabilities of flash and the design of the Purity Operating Environment, the factors below are neither relevant nor significant on FlashArray.
|
Factors |
Relevancy |
Details |
|---|---|---|
|
Stripe width and depth |
Automatic |
Purity Operating environment automatically distributes data across all drives in the array |
|
RAID level |
Automatic |
Pure FlashArray uses RAID-HA, designed to protect against three failure modes specific to flash storage: device failure, bit errors, and performance variability |
|
Intelligent data placement |
Insignificant |
Purity Operating Environment has been designed from the ground up to take advantage of flash’s unique capabilities as they are not constrained by the disk paradigm anymore, and, as such, “hot” and “cold” disk platter placements are not relevant |
For ease of bucket management, and to enable backups of Warm or Cold buckets, we recommend using separate Pure volumes for Hot/Warm, Cold, and Frozen buckets (if you decide to use Frozen on FlashArray) per indexer.
|
Bucket Type |
Volume count |
Location in indexes.conf |
|---|---|---|
|
Hot/Warm |
1 FA volume per indexer |
Separate volume stanza for Hot/warm buckets like
|
|
Cold |
1 FA volume per indexer |
Separate volume stanza for Cold buckets like
|
|
Frozen |
1 FA volume per indexer |
coldToFronzenDir or coldToFrozenScript under each <index> stanza |
Make sure to mount these FlashArray volumes on the relevant indexers onto the same mount point like “/hot” or “/cold” for the indexes.conf to be effective on the indexer.
As Pure FlashArray volumes are always thin-provisioned, Splunk Administrators can provision a large-sized volume to avoid adding additional volumes to meet the space growth.
Keep all the FlashArray volumes for all the indexers in a cluster at the same size to avoid imbalanced space usage.
Linux Mount options
You are welcome to use either EXT4 or XFS filesystems on the Splunk Indexers to mount the FlashArray volumes. As buckets age and when directories are removed, the underlying block storage has to be issued with TRIM/unmap commands to reclaim the space. To accomplish this, you can use the discard mount option which will issue the TRIM command to FlashArray to release the space occupied by those directories.
Following are the recommended mount options:
discard,noatimeIf the discard option is not a preferred option based on your standard operating procedure, make sure to issue the fstrim command on the mount point periodically, once a day or once a week, to release the space at the FlashArray level.
Logical Volume Manager
Recommended using the logical volume manager (LVM) at the indexer level to attach the FlashArray volume to a volume group and carve out the logical volume for the Hot/Warm or Cold tier out of it. This enables dynamic storage addition when the indexer needs more storage space for the Hot/Warm or Cold tier when they are hosted on Pure FlashArray.
Linux Best Practices
The Linux recommended settings for FlashArray, including multipathing queue settings, are documented under the Solutions page at the Everpure support site.