Intel® Select Solutions: Containerized Splunk

Want to learn more about Intel® Select Solutions for Containerized Splunk? The Splunk Data-to-Everything Platform built in an optimized environment delivers scalable, high-performance data analytics. Combining the industry-leading Splunk product set with a reference design that includes Intel® technologies helps organizations accelerate and scale their Splunk on-premises or hybrid private/public cloud deployments, transforming raw data into operational, business, and security intelligence and insights. The power of Splunk lies in its ability to handle any structure, any source, or any time scale of data. Organizations can investigate, monitor, analyze, and act on a wide variety of data sources across a myriad of use cases. The resulting insights can help identify security threats, optimize application performance, understand customer behavior, and more. As with any data center workload, optimal efficiency is the goal. Splunk efficiency can be measured by low search runtimes, high data ingestion rates, and high numbers of concurrent searches. To increase ease of deployment and manageability and achieve better resource utilization, containerized Splunk deployments are becoming more common. Intel® Select Solutions are developed from Intel’s experience with industry solution providers and software vendors, in addition to extensive collaboration with leading data center service providers. Splunk and Intel worked together to benchmark containerized Splunk workloads using 3rd Generation Intel® Xeon® Scalable processors, which feature hardware enhancements that benefit Splunk workloads. With the latest Intel Xeon Scalable processors, Splunk can take advantage of larger and better-performing core counts, increased memory performance and capacity, and more and faster I/O with PCI Express 4. Testing of container-based scalability revealed that both indexing and search performance scale linearly, up to 4.8x and 5.1x, respectively, as more indexers or search heads are added. Tests also showed that Splunk configurations with the latest Intel® processors consistently out-perform configurations based on previous-generation Intel processors, whether the tests are run in containers or on bare metal. Solution benefits include the following: • Fast insights. Splunk provides real-time insights across the application development cycle and allows organizations to add new use cases by quickly deploying new indexers and search heads. Simplify the data-harnessing process with 3rd Gen Intel Xeon Scalable processors for Splunk deployments. • Easy deployment and management. Splunk’s fully managed platform-as-a-service (PaaS) solution enables organizations to focus on their business and not on their infrastructure. Splunk Operator for Kubernetes makes it easy to deploy Splunk Enterprise on the Kubernetes platform. • Low costs. Disaggregating compute and storage can help shrink infrastructure footprint and significantly lower costs. Compute and storage can scale independently as future demands dictate. • Efficient storage. Use Splunk SmartStore to efficiently balance hot cache and S3 object storage for exabyte-scale cold data. The combination of Splunk and Intel technologies provides a feature-rich, high-performance, and future-ready solution that can scale well beyond most needs. Plus, Kubernetes enables the rich functionality that Splunk Enterprise offers with the user-friendliness and production-readiness of container-native software. The bottom line? You can index more data, reduce search times, and increase the number of concurrent searches with Intel architecture-based Splunk deployments.