Solution White Paper H15264 - Vblock System 540 Infrastructure for Splunk Enterprise


  Vblock System 540 Infrastructure for Splunk Enterprise

   Converged System Solution Guide - H15624



This solution guide describes a Dell EMC Vblock System 540 converged infrastructure solution that highlights flexible scaling options and tight integration with Splunk Enterprise for analyzing large quantities of machine data.


Splunk provides a single user interface for its complementary products Splunk Enterprise and Hunk so that enterprises can gain insights into realtime and historical machine data.  Splunk Enterprise provides end-to-end visibility across your IT infrastructure to enable informed, data-driven decisions.  The Hunk analytics platform brings the power of Splunk Enterprise to Hadoop to seamlessly search and analyze Hadoop-based data as part of your Splunk Enterprise deployment.  Hunk gives you the power to rapidly detect patterns and find anomalies across petabytes of raw data in Hadoop without the need to move or replicate data.



Solution Architecture


Vblock System 540 reference architecture for Splunk Enterprise


Reference architecture for Hunk Vblock System 540 and Converged Technology Extension for Isilon storage


The primary benefits of running Splunk Enterprise and Hunk on Dell EMC Converged Systems are:

  • Splunk-validated configurations—Jointly validated with Splunk, findings that meet or exceed the performance of Splunk’s documented reference hardware.
  • Optimal storage tier alignment for Splunk Enterprise—Flexible sizing options to achieve the desired retention and performance profile for indexing and searching data in Splunk Enterprise.
  • Cost-effective and flexible scale-out—Scale-out compute and storage management in a single converged platform package.
  • Powerful data services—Secure data encryption and data reduction services, along with integrated copy data management for efficient backup and restore capabilities.


This solution guide discusses the following:

  • Hardware architecture overview of a Vblock System 540 with the Converged Technology Extension for Isilon.
  • Splunk architecture overview and an explanation of how a Vblock System 540 with the Converged Technology Extension for Isilon storage aligns to Splunk Enterprise indexing and data management implementation.
  • Splunk-validated sizing guidance and best practices for a Vblock System 540 with the Converged Technology Extension for Isilon storage to achieve the best performance for distributed or clustered indexer Splunk Enterprise deployments.
  • Configuring Hunk for querying data in Hadoop.
  • Performing data visualization with Hunk.
  • An overview of the test methodology that we used to measure storage performance and latency.
  • Additional benefits of using a Vblock System 540 to host Splunk Enterprise, including:

         - Dell EMC XtremIO data reduction storage savings

         - XtremIO Virtual Copy (XVC)  for space-efficient and fast backup and restore of Splunk Enterprise hot/warm indexed data






Solution White Paper



Follow us on Twitter:

Tweet this document:

Click here to learn more: