Deployment Architecture

Before planning to deploy a Distributed Search environment, is there a partition model recommendation before installing Splunk 6.4 on my Linux servers?

Jrubalcaba
Explorer

I am planning to deploy a Splunk Distributed Search Architecture in a mixed environment of 500 servers mostly Windows and some Red Hat Enterprise (RHEL) Linux 7. Splunk hosts will be RHEL 7.2 I will have two search heads: Enterprise & Security, a 3 node indexer clustered on the Splunk application level, and a separate Deployment Server.

I read that Splunk will create the necessary directories during installation. Is there partition model recommendation or LVM I should have ready before installing Splunk 6.4 in my Linux servers? Or should I just let Splunk create directories automatically during install?

See my current Linux partitions below:

/root           50G
/home/  200 G
/boot    500mb
/swap/   8G
/tmp
/var
/var/tmp/
/var/log/
/var/log/audit/

ddrillic
Ultra Champion

You probably should let Splunk install itself under /opt/splunk and let it create its directories.

Special attention is usually needed for the indexer's file system. Usually, we would point it to a distinct file system such as /SplunkIndexData with high capacity based on your needs.

dstonecypher_sp
Splunk Employee
Splunk Employee

Go with whatever your sysadmins are used to, except put /opt/splunk on its own partition if and only if that makes backups or recovery easier for you.

On an indexer, I suggest making sure your index location (either /opt/splunk/var/lib/splunk/, or /data/, or whatever) its own partition, too.

As for directories, just let Splunk do it. The only thing you may need to do by hand is the index location on the indexers, if not using the default.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...