Deployment Architecture

Hardware vs. software RAID

hulahoop
Splunk Employee
Splunk Employee

For indexer requirements, the following is listed as the recommendation configuration in the Planning Your Splunk Deployment Guide:

8 300GB SAS hard disks at 10,000 rpm each in RAID 10
   * capable of 1200 IO operations / second (Iopps)

Does this recommendation change when using software vs. hardware RAID? If so, how?

1 Solution

jrodman
Splunk Employee
Splunk Employee

The only change with soft raid is that you may want to invest a little more in CPU than you might with hardware raid, especially if you are considering using raid 5 (which we obviously recommend against for the warm buckets). The read and write rates of Splunk are typically more bursty than sustained, so the CPU increase is not likely to be very large.

Software raid is typically a higher total performance solution, because the bandwidth of commodity processors grows much faster than custom raid solutions. The typical stumbling block is the boot behavior on disk failure. That's general IT stuff though, not terribly Splunk-specific.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

The only change with soft raid is that you may want to invest a little more in CPU than you might with hardware raid, especially if you are considering using raid 5 (which we obviously recommend against for the warm buckets). The read and write rates of Splunk are typically more bursty than sustained, so the CPU increase is not likely to be very large.

Software raid is typically a higher total performance solution, because the bandwidth of commodity processors grows much faster than custom raid solutions. The typical stumbling block is the boot behavior on disk failure. That's general IT stuff though, not terribly Splunk-specific.

gkanapathy
Splunk Employee
Splunk Employee

Let's be more clear: stay away from RAID 5 for the hot/warm volume. It's not a problem for the cold volume.

hulahoop
Splunk Employee
Splunk Employee

Thanks, Josh! Very helpful. Stay away from RAID 5!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...