Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Big and Flashy with Dell EMC

1,408 views

Published on

SplunkLive Breakout Session at Nashville 2016

Published in: Technology
  • Be the first to comment

Big and Flashy with Dell EMC

  1. 1. Buckets Full of Happy Tiers Don Green
  2. 2. © Copyright 2016 Dell Inc.2 Disclaimer During the course of this presentation, we may make forward looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in the this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.
  3. 3. © Copyright 2016 Dell Inc.3 Splunk is now a business critical application:  Size of Splunk deployments is increasing rapidly  Splunk search performance is important  Availability/Reliability is becoming crucial  Underlying infrastructure is aligning to enterprise IT  Efficiency at scale is becoming a top concern Splunk Trends we are seeing… Dell EMC provides a scalable and efficient enterprise solution for deploying Splunk.
  4. 4. © Copyright 2016 Dell Inc.4 Performance  Volume Of Ingest  Search Performance  More Users  Big Apps Why Does Splunk Grow? Dell EMC provides a scalable and efficient enterprise solution for deploying Splunk. Capacity  Volume Of Ingest  Index Retention Periods  Indexer Clustering  Big Apps
  5. 5. © Copyright 2016 Dell Inc.5 Scaling Splunk Then comes the real world… ES, UBA, ITSI Compliance Retention
  6. 6. © Copyright 2016 Dell Inc.6 Splunk: Decouple Compute From Storage More than 200GB/day? More than 6 month retention? Still using DAS in a server? You have too many servers…you should decouple compute from storage.
  7. 7. © Copyright 2016 Dell Inc.7 Splunk Index Architecture Hot Warm Thawed Frozen Home Path Cold Path (cheaper storage) Thawed Path Frozen Path or deleted Events Hot bucket is full (Out of volume space, or too many warms) (Out of space, or bucket is Old) (Explicit user action) Cold
  8. 8. © Copyright 2016 Dell Inc.8 WHY DELL EMC FOR SPLUNK OPTIMIZED INFRASTRUCTURE FOR BIG & FAST DATA Optimized Shared Storage & Tiering Hot & Warm Data Deployed On XtremIO or ScaleIO Cold & Frozen Data Deployed On Isilon Powerful Data Services Encyption & Security Index File Compression Deduplication Of Clustered Indexes Snapshots For Backups Cost-Effective & Flexible Scale-Out Scale-Out Capacity & Compute Independently Or As Converged PlatformFrozen Cold Warm Hot
  9. 9. © Copyright 2016 Dell Inc.9 Data Services For Hot & Warm Data Self-Encrypting Flash Drives Index File Compression Dedupe Clustered Index Copies In-Memory Data Copy Services DELL EMC XTREMIO & SPLUNK ALL-FLASH HIGH SPEED INFRASTRUCTURE FOR HOT & WARM DATA Scale-Out Flash For I/O- Bound Data >1M IOPS & <1ms Latencies 5TB  320TB High-Speed Search Accelerate SuperSparse & Rare Searches 150K IOPS/Brick Warm Hot
  10. 10. © Copyright 2016 Dell Inc.10 DELL EMC SCALEIO & SPLUNK EXISTING SERVER + DISK CAPACITY LEVERAGED TO HOLD HOT AND WARM DATA Servers Network Storage Shared pool of storage and compute from server resources using Dell EMC ScaleIO Warm Hot SOFTWARE-DEFINED SCALE-OUT SAN MASSIVE SCALABILITY SUPREME ELASTICITY STRONG PERFORMANCE UNPARALLELED FLEXIBILITY COMPELLING ECONOMICS Hyper-converged infrastructure for Splunk Leverage under-utilized HD/SSD storage from existing Servers 10M+ IOPS 1000+ Servers Reduce CAPEX 50%
  11. 11. © Copyright 2016 Dell Inc.11 Powerful Data Services DELL EMC ISILON & SPLUNK LOW-COST & SECURE SCALE-OUT FOR COLD AND FROZEN DATA Hadoop and Splunk Single Common Data Lake for Hadoop and Splunk Bottomless Cold Bucket No need to freeze or thaw. Single Volume scaling to 68 PB Encyption & Security Index File Compression Deduplication Of Clustered Indexes Snapshots For Backups Cold
  12. 12. © Copyright 2016 Dell Inc.12 DELL EMC REFERENCE ARCHITECTURES FOR SPLUNK ENTERPRISE XtremIO and Isilon Reference Architecture ScaleIO and Isilon Reference Architecture
  13. 13. © Copyright 2016 Dell Inc.13 WHY VCE FOR SPLUNK? CLOUD-LIKE EXPERIENCE, ON-PREMISE SOLUTION Factory Physical and Logical Build Roadmap and New Feature Planning Compliance-Ready Configuration and Patch Management Performance and Availability Single Support Through VCE We deliver SLAs, not just Infrastructure…
  14. 14. © Copyright 2016 Dell Inc.14 Scaling Splunk The Ideal Scenario…
  15. 15. © Copyright 2016 Dell Inc.15 SPLUNK APPS FROM DELL EMC XtremIO App Isilon App VNX App More coming!!
  16. 16. Dell EMC / Splunk Top 10
  17. 17. © Copyright 2016 Dell Inc.17 1. When in doubt, follow published Dell EMC best practices. Top 10
  18. 18. © Copyright 2016 Dell Inc.18 • Do it across Dell EMC Platforms – VMware – XtremIO – VNX – VMAX – ScaleIO – VSAN – Isilon – ECS #1 - Follow published Dell EMC best practices In the absence of Splunk-specific Best Practice, use base.
  19. 19. © Copyright 2016 Dell Inc.19 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! Top 10
  20. 20. © Copyright 2016 Dell Inc.20 • Disable Transparent Huge Pages (THP) • Increase ulimit for number of open files AND number of processes • Enable Hyper-Threading Technology (HHT or HT) – Provides ~30% performance benefit – ALWAYS allocate the equivalent of the recommended number of physical cores when provisioning resources in a virtualized environment #2 – Use Splunk Best Practices 20
  21. 21. © Copyright 2016 Dell Inc.21 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure Top 10
  22. 22. © Copyright 2016 Dell Inc.22 #3 – Watch The Levers You Pull… Scaling is easy, if we know what is scaling! Performance  Volume Of Ingest  Search Performance  More Users  Big Apps Capacity  Volume Of Ingest  Index Retention Periods  Indexer Clustering  Big Apps Scaling is easy, if we know what is scaling!
  23. 23. © Copyright 2016 Dell Inc.23 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure 4. When decoupling, networks are REALLY important. Top 10
  24. 24. © Copyright 2016 Dell Inc.24 • Dedicated Fabrics – H/W is FC SAN – Cold/Frozen is IP LAN • Use 10GB...trust us. • Not a fan of converged fabrics for Splunk…today. #4 – Networking Matters
  25. 25. © Copyright 2016 Dell Inc.25 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure 4. When decoupling, networks are REALLY important. 5. If using Isilon for Cold, configure SmartConnect Advanced PROPERLY! Top 10
  26. 26. © Copyright 2016 Dell Inc.26 • SmartConnect = Load Balancer for Isilon Cluster • Use it with FQDN for NFS or… #5 – Do Isilon SmartConnect Advanced RIGHT!!! Client DNS Server 2 Cluster Node1 10.9.44.11 SmartConnect VIP 10.9.44.10 Node2 10.9.4.12 Node3 10.9.44.13 3 4 5 6
  27. 27. © Copyright 2016 Dell Inc.27 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure 4. When decoupling, networks are REALLY important. 5. If using Isilon for Cold, configure SmartConnect Advanced PROPERLY! 6. If you are going virtual and using XtremIO, us vSphere 5.5+. Top 10
  28. 28. © Copyright 2016 Dell Inc.28 • It’s all about automating space reclamation. • Check out this blog. • XtremIO Host Configuration guide - key settings described on pages 36-38 #6 – Use VMware 5.5+ with XtremIO
  29. 29. © Copyright 2016 Dell Inc.29 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure 4. When decoupling, networks are REALLY important. 5. If using Isilon for Cold, configure SmartConnect Advanced PROPERLY! 6. If you are going virtual and using XtremIO, us vSphere 5.5+. 7. Traditional Benchmarks are not to be trusted… Top 10
  30. 30. © Copyright 2016 Dell Inc.30 #7 - Existing Benchmark Tools Not Accurate Advantages Drawbacks Bonnie++ (http://www.coker.com.au/bonnie++/) • Simple to install and test • Current Splunk standard for benchmarking IOPS (random seeks per second) • Splunk App to guide usage of running and collecting bonnie++ results (https://splunkbase.splunk.com/app/3 002/) • Differences in results depending on bonnie++ version (1.03e vs. 1.96) • Latency numbers are questionable • Poor at accurately indicating performance of Splunk with shared storage environments (block size, read/write workload, etc) SplunkIT (https://splunkbase.splunk.com/app/749/) • Simple to setup • Measures indexing throughput • Measures search response time • No multi-user scenarios • No concurrent/streaming workloads • No support for distributed environments (single instance only)
  31. 31. © Copyright 2016 Dell Inc.31 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure 4. When decoupling, networks are REALLY important. 5. If using Isilon for Cold, configure SmartConnect Advanced PROPERLY! 6. If you are going virtual and using XtremIO, us vSphere 5.5+. 7. Traditional Benchmarks are not to be trusted… 8. Trust in joint Dell EMC and Splunk validations Top 10
  32. 32. © Copyright 2016 Dell Inc.32 • Dell EMC Builds It • Splunk Tests It • We publish – ”Meets or exceeds Splunk’s reference hardware.” • You get our commitment to your success. #8 - Trust in Splunk Validation Multi ServerSingle Server
  33. 33. © Copyright 2016 Dell Inc.33 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure 4. When decoupling, networks are REALLY important. 5. If using Isilon for Cold, configure SmartConnect Advanced PROPERLY! 6. If you are going virtual and using XtremIO, us vSphere 5.5+. 7. Traditional Benchmarks are not to be trusted… 8. Trust in joint Dell EMC and Splunk validations. 9. The Splunk Apps for Dell EMC are handy, but need your creativity! Top 10
  34. 34. © Copyright 2016 Dell Inc.34 • Go Install them! – Apps = The Pretty Face… – TAs are slick... • Use cases make them really awesome! – What would you do with them? – Share it with us! #9 – Install the Splunk Apps from Dell EMC XtremIO App Isilon App VNX App More coming!!
  35. 35. © Copyright 2016 Dell Inc.35 1. When in doubt, follow published Dell EMC best practices. 2. Do the same for Splunk! 3. Slight changes in Splunk = Massive impacts on infrastructure 4. When decoupling, networks are REALLY important. 5. If using Isilon for Cold, configure SmartConnect Advanced PROPERLY! 6. If you are going virtual and using XtremIO, us vSphere 5.5+. 7. Traditional Benchmarks are not to be trusted… 8. Trust in joint Dell EMC and Splunk validations. 9. The Splunk Apps for Dell EMC are handy, but need your creativity! 10. Don’t hesitate, call a Dell EMC Splunk Ninja TODAY!!! Top 10
  36. 36. © Copyright 2016 Dell Inc.36 #10 – Call a Dell EMC Splunk Ninja • We are Splunk SE trained • We know our kit and Splunk • Global representation of 40+ • SME resources…use us • Who doesn’t love a Ninja? Splunk.Ninjas@Dell.com

×