Explore Splunk infrastructure to meet every business need

[StorageExperts]

Discover the variety of solutions available from HPE to build a flexible, scalable, and easy-to-manage infrastructure for Splunk deployments of any size and for any use case. – By Keith Vanderford, Storage Solutions Engineer, HPE

Splunk deployments require a robust infrastructure with no bottlenecks, but every environment and every business case is different and has unique requirements. Because there is no one-size-fits-all solution, we offer a broad portfolio of options to fit every use case and every size deployment. Every one of these solutions has plenty of resources to power your Splunk AI implementation. Each solution can be customized to give you an optimized environment that meets your demanding requirements now, and also provides the flexibility to grow and expand to meet your future business goals. Take a look at the solutions described here for an overview of each one – and learn which one best meets your business needs.

HPE InfoSight intelligent data platform

All of the storage solutions available from HPE are fully integrated with HPE InfoSight, which is the industry’s most advanced cloud-based AI for infrastructure. HPE InfoSight uses cross-platform predictive analytics to enable workload visibility, improved performance, higher availability, and optimized resource utilization. You also get trend analysis and AI-powered intelligent recommendations for replacement of degraded components before failures occur. Locate underutilized or overloaded virtual resources without effort, and reassign resources to make your entire Splunk deployment more efficient. This enables you to avoid problems and manage growth easily.

Simplified management with HPE GreenLake

All HPE storage and compute solutions used with Splunk can be managed through a cloud-enabled single pane of glass using Data Services Cloud Console (DSCC), which is accessible from anywhere on any device. This ensures users have a uniform and comprehensive all-in-one hybrid cloud experience across all HPE platform options. This hybrid cloud storage and data management solution delivers simpler operation, and empowers faster innovation for your enterprise. HPE GreenLake delivers the industry’s most comprehensive solution to store, manage, and protect data across hybrid cloud.

Low-ingest, low-growth environments: HPE Alletra 5000

For small environments with 1 TB/day or less of ingest, the HPE Alletra 5000 series storage array can be a good fit. It is a cloud native, enterprise-grade, flash-enhanced hybrid architecture that is ideally suited for workloads that do not require an all-flash solution. It includes the predictive analytics of HPE InfoSight to assure you have fast, reliable access to data and 99.9999%[1] measured data availability.

Virtualized environments: HPE GreenLake Private Cloud Business Edition

For virtualized Splunk deployments, we recommend HPE GreenLake for Private Cloud Business Edition. With this solution, the entire Splunk stack is virtualized, and is simple to manage from a single pane of glass using the VMware vSphere interface. Private Cloud Business Edition enables you to configure the optimum ratio of compute to storage for your environment to eliminate bottlenecks and ensure no resources are underutilized.

Some of the unique advantages of HPE GreenLake Private Cloud Business Edition are self-installation, and automated resource deployment driven by policies and templates. Private Cloud Business Edition provides a significant benefit for Splunk administrators and users by making it simple and quick to deploy a large number of Splunk instances for distributed deployments with just a few clicks. Together, these features give you cloud-like agility in your on-premises deployment at a much lower cost than the public cloud. HPE GreenLake for Private Cloud Business Edition is fully integrated with HPE InfoSight, and is supported with the HPE Alletra 6000, HPE Alletra MP, and HPE SimpliVity Gen11.

Bare metal environments: block storage on HPE Alletra 6000/9000/MP

For non-virtualized environments, we recommend using HPE Alletra 6000 series, HPE Alletra 9000 series, HPE Alletra MP Storage arrays, or HPE GreenLake for Block Storage, along with HPE ProLiant servers or the HPE Alletra Storage Server 4110 series in a bare-metal configuration.

The HPE Alletra 6000 powers your data from edge to core with the cloud experience for business-critical workloads. High-ingest use cases, multi-tenant environments, and mission-critical workloads will benefit from the HPE Alletra 9000 series or HPE Alletra MP platform. These arrays deliver the extreme performance and extreme reliability you need to ensure fast indexing of new data as well as consistently fast searches for your mission-critical or high-ingest Splunk workloads. For use cases with the most demanding performance requirements, Hewlett Packard Enterprise recommends using HPE Alletra Storage Server 4110 with internal NVMe SSDs for the hot and warm tiers of Splunk buckets. Each platform is designed to give your Splunk deployment rock-solid reliability, but still provide all the flexibility you need to quickly and easily adapt to changing levels of data ingest and the increasing demands of users.

SLA-driven environments: HPE GreenLake for Block Storage

Here we recommend HPE GreenLake for Block Storage for SLA-driven environments. It is deployed with a pay-as-you-go, scale-on-demand model that guarantees 100% data availability for mission-critical Splunk deployments, and 6-nines for all others. The service can be provided by HPE Alletra 6000, HPE Alletra 9000, HPE Alletra MP, or a combination, depending on your needs. This gives you the flexibility to support any workload, whether business-critical or mission-critical, in the most cost-efficient manner.

With HPE GreenLake for Block Storage fully managed service, your VMs and infrastructure are managed for you. You no longer have to manage your storage infrastructure, you can access it on-demand as a service, allowing you to focus on meeting your business objectives

Extreme performance: HPE Alletra Storage Server 4110

For Splunk deployments that require extremely fast indexing and data searches, Hewlett Packard Enterprise recommends a bare metal configuration taking advantage of the HPE Alletra Storage Server 4110. These servers are designed with fast Intel^® Xeon^® Scalable CPUs and local NVMe storage to provide high-performance computing and fast, low-latency storage. This is perfect for Splunk’s hot tier and SmartStore local cache, or the hot and warm buckets in Splunk Classic. The result is optimal data processing speed, throughput, and capacity to help your organization store large amounts of data and extract value from it quickly and efficiently, without cumbersome management overhead. Management of these servers is simple and intuitive through Data Services Cloud Console using Compute Ops Management.

For a Splunk Classic deployment, Splunk’s cold buckets are stored on HPE GreenLake for File Storage. If there is a need for a frozen tier of data, the frozen buckets could also be stored on HPE GreenLake for File Storage, or they could be moved to a scale-out software defined storage system running on another group of HPE Alletra Storage Server 4000 series. In a Splunk SmartStore deployment, HPE GreenLake for File Storage would not be needed since SmartStore does not use cold or frozen buckets. Instead, the remote copy of Splunk’s SmartStore warm tier would be stored in Scality RING S3 object storage running on another set of HPE Alletra Storage Server 4000 series.

Containerized environments

We fully support running Splunk in containers. This can be implemented in your datacenter with Red Hat OpenShift Container Platform or another Kubernetes platform. Running Kubernetes on a container platform using HPE servers and storage on-premises gives you all the benefits of containers and the cloud, with none of the disadvantages or risks associated with moving your data to the public cloud.

The HPE CSI driver makes the storage available to the containerized environment through the use of persistent volumes. Because all HPE Alletra storage arrays are built for modern applications, it is not necessary to configure the array before it can be used in a containerized environment. The cluster dynamically provisions volumes on the HPE Alletra Storage array as needed to support the workloads you create in the cluster.

Cold and frozen buckets: HPE GreenLake for File Storage

Regardless of which of these solutions are implemented, many Splunk environments have additional storage requirements for cold and/or frozen buckets for long-term data retention. HPE GreenLake for File Storage delivers fast NVMe-based file shares to give your Splunk deployment fast, predictable, and sustained enterprise-grade performance at scale, with the flexibility to grow seamlessly as your business needs change. This flash-based storage system is also easy to deploy and manage through Data Services Cloud Console (DSCC), using Data Ops Manager.

The advanced data reduction algorithms built into HPE GreenLake for File Storage result in an ability to achieve additional reduction on Splunk cold and frozen buckets that are already highly compressed. With this additional data reduction, the capacity required to store your data is reduced, lowering your overall TCO.

SmartStore S3 or frozen buckets: HPE Alletra Storage Server 4000 series and Scality RING

Any of these Splunk environments might benefit from an extremely scalable software-defined storage system (SDS) running on HPE Alletra Storage Servers 4000 such as Scality RING, to meet long-term retention requirements. For Splunk SmartStore deployments, Hewlett Packard Enterprise and Scality have three solutions that are designated as “SmartStore Ready” by Splunk. These take advantage of the S3-compliant object storage of Scality RING. If an environment does not require Splunk SmartStore, the S3 object store can be used for frozen buckets in a Splunk Classic configuration.

Explore HPE solutions

We offer a broad HPE portfolio of solutions to satisfy your demanding Splunk infrastructure requirements, no matter what your business use case is.

To learn more about the great options for deploying Splunk with HPE GreenLake, HPE Alletra Storage, and HPE Servers, and to start determining which solution best meets your business needs, read the white paper: HPE Alletra Storage Solutions for every Splunk infrastructure need

[1] "Uptime guarantees that deliver,” May 2021

---

Meet Storage Experts blogger Keith Vanderford, Storage Solutions Engineer, HPE

Keith is on the worldwide storage solutions team at HPE with more than 15 years of experience with HPE Storage products. For the past several years, he’s focused primarily on running data analytics software with HPE Storage.

Storage Experts
Hewlett Packard Enterprise

twitter.com/HPE_Storage
linkedin.com/showcase/hpestorage/
hpe.com/storage