Splunk

High-performance, low-cost, scalable storage for SmartStore single-site and multi-site deployments

Splunk and Scality have partnered to deliver a scalable unified platform for operational intelligence. Index larger data sets and retain them longer at a fraction of the cost, while reducing complexity and increasing flexibility.

How Splunk + Scality lowers cost while increasing operational functionality and agility

Image
Splunk Smartstore

With Splunk SmartStore, storage is decoupled from compute, allowing resources to be scaled independently and, therefore, more efficiently. The resulting TCO reduction is further compounded by higher utilization. SmartStore also reduces storage costs by offloading older, less frequently used data (warm buckets) to Scality RING, without impacting search performance. 

Scality RING holds the master copy of warm buckets while indexers’ local storage is used for hot and cache copies of warm buckets. With most data residing on Scality RING, the indexer maintains a local cache that contains a minimal amount of data: hot buckets, and copies of warm buckets participating in active or recent searches, and bucket metadata. This renders indexers stateless for warm and cold data, boosting operational flexibility and agility.

Scality RING is Splunk SmartStore ready for simplified single and multi-site deployments

Software-defined Scality RING has supported the Amazon S3 API since 2010 and is an ideal storage tier for Splunk SmartStore. Scality offers Splunk customers petabyte-scale storage and multiple data protection schemes for greater choice and flexibility in their SmartStore deployments.

No other vendor can accommodate all three SmartStore deployment models

Uniquely validated as a SmartStore ready storage solution for Splunk deployments in all three architectures, Scality RING provides efficient and scalable business continuance and high availability solutions for Splunk big data analytic applications.

Single-site architecture with erasure coding protects against the loss of disks and even entire servers.

Multi-site active-active architecture with erasure coding as well as asynchronous replication between two sites protects against the loss of disks, servers, and even an entire site. Active-active is best suited for multi-site Splunk deployments where inter-site latency goes up to 100ms.

Multi-site stretched architecture with erasure coding as well as synchronous replication across three sites protects against the loss of disks, servers, and even an entire site. With a stretched architecture, Splunk customers’ experience is akin to what they would have on AWS within an Availability Zone. A stretched architecture is best suited for multi-site deployments where returning consistent and complete results is mandatory, even during a data center failure event.

 

Benefits

Flexibility

No other solution is validated to support all three Splunk SmartStore deployment models.

Efficiency

Scality RING’s stretched model is unique in ensuring data availability protection against a full data center failure — without requiring full copies of data in each data center.

Scalability

Scality RING has been proven in production with high-throughput replication of Splunk SmartStore data across data centers.

  • splunk diagram

    The solution

    Learn how Scality RING + Splunk helps you index larger data sets and retain them longer — at a fraction of the cost — while reducing complexity and increasing flexibility.