Splunk

How Splunk + Scality lowers cost while increasing operational functionality and agility

With Splunk SmartStore, storage is decoupled from compute, allowing resources to be scaled independently and, therefore, more efficiently. The resulting TCO reduction is further compounded by higher utilization. SmartStore also reduces storage costs by offloading older, less frequently used data (warm buckets) to Scality RING, without impacting search performance.

Scality RING holds the master copy of warm buckets while indexers’ local storage is used for hot and cache copies of warm buckets. With most data residing on Scality RING, the indexer maintains a local cache that contains a minimal amount of data: hot buckets, and copies of warm buckets participating in active or recent searches, and bucket metadata. This renders indexers stateless for warm and cold data, boosting operational flexibility and agility.

Scality RING is Splunk SmartStore ready for simplified single and multi-site deployments

Software-defined Scality RING has supported the Amazon S3 API since 2010 and is an ideal storage tier for Splunk SmartStore. Scality offers Splunk customers petabyte-scale storage and multiple data protection schemes for greater choice and flexibility in their SmartStore deployments.

No other vendor can accommodate all three SmartStore deployment models

Uniquely validated as a SmartStore ready storage solution for Splunk deployments in all three architectures, Scality RING provides efficient and scalable business continuance and high availability solutions for Splunk big data analytic applications.

Single-site architecture with erasure coding protects against the loss of disks and even entire servers.

Multi-site active-active architecture with erasure coding as well as asynchronous replication between two sites protects against the loss of disks, servers, and even an entire site. Active-active is best suited for multi-site Splunk deployments where inter-site latency goes up to 100ms

Multi-site stretched architecture with erasure coding as well as synchronous replication across three sites protects against the loss of disks, servers, and even an entire site. With a stretched architecture, Splunk customers’ experience is akin to what they would have on AWS within an Availability Zone. A stretched architecture is best suited for multi-site deployments where returning consistent and complete results is mandatory, even during a data center failure event.

Read more here about Scality RING for Splunk SmartStore single and multi-site deployments, plus how Scality partnered with HPE to test and validate the two Splunk multi-site architectures.