NetApp collaborated with Function1, a Splunk certified partner to install, configure, and test a large production size deployment of Splunk Enterprise. These tests were conducted in a lab environment to provide unbiased results in comparing E-Series storage systems to industry-current commodity servers with internal disks, as well as comparing different E-Series storage system configurations. To further ensure a fair comparison, the E-Series and the commodity servers with internal disks were configured to closely mirror each other.

The tests consisted of index rate, static and stream searches, and node cluster failover and controller failover. The following charts and information summarizes the test results.

Figure 1 Baseline Chart.gif

Figure 1) Baseline NetApp E-Series vs. Commodity Servers with Internal Disks

Figure 2 Average Indexing chart.png

Figure 2) Baseline NetApp E-Series vs. Commodity Servers with Internal Disks – Average Indexing rate

Based on the baseline testing of the E-Series vs. commodity severs with internal disks, the E-Series provides:

    • Similar indexing performance rate (Kb/sec)
    • An average of 69% search performance gains
    • An average of 31% static search performance gains
    • An average of 107% stream search performance gains

In addition, the E-Series configuration had a replication factor #2 vs. replication factor #3. The reduction in replication does not impact reliability with the E-Series having 99.9999% uptime and RAID protection of the data.

Figure 3 Node Cluster Failover Chart.png

Figure 3) Node Cluster Failover

The chart above shows total run time per second for a node cluster failover. A node cluster failover occurs when one or more Splunk nodes are offline. The E-series provides 30% static performance gains compared to commodity servers under a Splunk Cluster Node Failure stress test.

Figure 4 Controller Failover chart.png

Figure 4) E-Series Controller Failover – Stream Search

Designed with no single point of failure, the NetApp E-Series has fully redundant I/O paths with automated failover. The stream search performance test with E-Series storage controller failure proved how well E-Series systems can provide consistent performance even during component failure. The difference in performance between an E-Series system with or without a storage controller failure is very minimal.

In summary, through NetApp and Function1’s collaboration, NetApp’s Splunk Enterprise storage solution was verified as a better option than traditional commodity servers with internal drives.  Specifically, the NetApp E-Series:

    • Provided similar indexing and higher search performance.
    • Was capable of greater performance with lower disk IOPS and a more efficient configuration (replication factor of 2 vs. factor of 3).
    • Continues to provide superior search performance during a Splunk cluster node faiover.
    • Provides consistent high performance during component failure (storage controller, disk and other HW failures), and provides great modular flexibility to support different Splunk deployments requirements.

For more details on NetApp E-Series for Splunk Enterprise, read this lab validation report.


Mike McNamara

Mike McNamara is a senior manager of product and solution marketing at NetApp with over 25 years of storage and data management marketing experience. Before joining NetApp over 10 years ago, Mike worked at Adaptec, EMC and Digital Equipment Corporation. Mike was a key leader driving the launch of the industry’s first unified scale-out storage system (NetApp), iSCSI and SAS storage system (Adaptec), and Fibre Channel storage system (EMC CLARiiON ). In addition to his past role as marketing chairperson for the Fibre Channel Industry Association, he is a member of the Ethernet Technology Summit Conference Advisory Board, a member of the Ethernet Alliance, a regular contributor to industry journals, and a frequent speaker at events.