Deployment Architecture

Quick poll: Anyone using ext4? Have you run into any issues?

Lowell
Super Champion

I'm planning on migrating Splunk instance to new hardware and will be upgrading the OS at the same time, and I'd like to move to "ext4" due to the extent-based file allocation, online fragmentation capabilities, and so on.

There's been a couple questions about ext4 on this site and per splunk support there is still no official "ext4" support yet as of Splunk 4.2.3, so I figured I'd see if anyone in the community has any experience on this.

If you're using ext4 I'd love to know about it.

Please include the following: (Additional details welcomed)

  • Linux distro:
  • Kernel version:
  • Splunk version:
  • Comments: (Works well / has problems / is it notably faster or slower?)
Tags (2)
0 Karma

mdonnelly_splun
Splunk Employee
Splunk Employee

For those who stumble across this query - the list of supported file systems now includes EXT4.

The complete list of supported file systems is found here:

http://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Lowell, I run ext4 on my 4.2.1 test instance on Ubuntu lucid. But, being it's strictly used for app development and config shakeouts I can't give any positive or negative comments on performance. In terms of basic functionality, Splunk seems to run just fine.

0 Karma

timothy_e_rabor
Explorer

I'm in the same boat as you and was hoping to see an answer here. I'm moving forward and hope I don't have to downgrade. Maybe I'll have some results to post in the next few days.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...