The VAST Data COLD.FLASH storage architecture provides a high performance, scalable and resilient Splunk platform for core Splunk Enterprise and Splunk Enterprise Security (ES) by significantly reducing the SSD capacity up to 70% within each Index server (1 day of Hot/Warm) and utilizing VAST’s Universal Storage to provide the scalable all-flash cold storage buckets to accelerate search performance, regardless of the search width.
The VAST all-flash shared storage cluster combines 3D XPoint technology, QLC Flash, low-overhead next generation erasure codes and unprecedented global data reduction to reduce storage complexity and enable a lower total cost of Splunk storage acquisition with all hot performance combined with cold storage economics.
Sub-millisecond read latency for all Splunk data, future-proof your Splunk storage infrastructure
60% less expensive than tiered DAS storage
Scale Splunk to support any retention period, use a small amount of SSDs for hot/warm buckets, VAST NFS for cold buckets
Breaking Decades-old Tradeoffs
IT infrastructure generates massive streams of machine data every day, and thousands of organizations are deploying Splunk Enterprise to analyze their machine data in order to gain valuable operational intelligence. However, the deployment and optimization of Splunk presents complex storage sizing challenges. How much flash-based storage do you allocate for the Hot/Warm buckets? Bad decisions coupled with unpredictable future search requirements can result in poor cluster performance, inefficiencies and reduced insights. Splunk’s storage tiering exists for only one reason – optimizing storage costs. If storage costs weren’t an issue, flash would resolve this tradeoff.
A New Type of Splunk Storage Architecture
By applying new thinking to decades old storage problems, VAST has broken the long-standing tradeoff between storage performance and the cost of capacity to make it possible to simplify and accelerate Splunk searches – Search as wide as you would like.
VAST has pioneered many innovations to democratize flash: QLC flash translation, low-overhead erasure codes and groundbreaking global data reduction.
Scale storage performance and capacity independently, scale indexers and search heads independently of cluster capacity.
One, simple-to-manage scale-out file system appliance, NFS & S3 connectivity, no need for complex client-side file system client software
A small amount of SSDs or Optane for hot/warm buckets, VAST NFS for cold storage buckets.
Linear search performance, search extended data at hot speeds.
Minimizing the DAS footprint makes it easy and fast to upgrade Splunk clusters with a low replication factor.