NetApp collaborated with Function1, a Splunk certified partner to install, configure, and test a large production size deployment of Splunk Enterprise. These tests were conducted in a lab environment to provide unbiased results in comparing E-Series storage systems to industry-current commodity servers with internal disks, as well as comparing different E-Series storage system configurations. To further ensure a fair comparison, the E-Series and the commodity servers with internal disks were configured to closely mirror each other.
The tests consisted of index rate, static and stream searches, and node cluster failover and controller failover. The following charts and information summarizes the test results.
Figure 1) Baseline NetApp E-Series vs. Commodity Servers with Internal Disks
Figure 2) Baseline NetApp E-Series vs. Commodity Servers with Internal Disks – Average Indexing rate
Based on the baseline testing of the E-Series vs. commodity severs with internal disks, the E-Series provides:
- Similar indexing performance rate (Kb/sec)
- An average of 69% search performance gains
- An average of 31% static search performance gains
- An average of 107% stream search performance gains
In addition, the E-Series configuration had a replication factor #2 vs. replication factor #3. The reduction in replication does not impact reliability with the E-Series having 99.9999% uptime and RAID protection of the data.
Figure 3) Node Cluster Failover
The chart above shows total run time per second for a node cluster failover. A node cluster failover occurs when one or more Splunk nodes are offline. The E-series provides 30% static performance gains compared to commodity servers under a Splunk Cluster Node Failure stress test.
Figure 4) E-Series Controller Failover – Stream Search
Designed with no single point of failure, the NetApp E-Series has fully redundant I/O paths with automated failover. The stream search performance test with E-Series storage controller failure proved how well E-Series systems can provide consistent performance even during component failure. The difference in performance between an E-Series system with or without a storage controller failure is very minimal.
In summary, through NetApp and Function1’s collaboration, NetApp’s Splunk Enterprise storage solution was verified as a better option than traditional commodity servers with internal drives. Specifically, the NetApp E-Series:
- Provided similar indexing and higher search performance.
- Was capable of greater performance with lower disk IOPS and a more efficient configuration (replication factor of 2 vs. factor of 3).
- Continues to provide superior search performance during a Splunk cluster node faiover.
- Provides consistent high performance during component failure (storage controller, disk and other HW failures), and provides great modular flexibility to support different Splunk deployments requirements.
For more details on NetApp E-Series for Splunk Enterprise, read this lab validation report.