Splunk Smart Store deployed with Cloudian Hyperstore

Splunk SmartStore and Cloudian Hyperstore. 1. Allows for a Splunk user to scale only compute when needed by adding an indexer. 2. Allows for a Splunk user to scale data only when needed by using SmartStore to Tier Storage to Cloudian HyperStore. SmartStore & HyperStore Architecture. 1. Local storage. Hot buckets are always on local storage. No change from classic Splunk architecture. 2. Remote Storage - buckets are copied to Cloudian Hyperstore when they roll from hot to warm. Cloudian HyperStore now provides data protection. Splunk no longer maintains Replications on the indexers. 3. Cache Manager moves recently read buckets to the local cache. Each indexer has a cache manager that operates independently. Retrieving buckets from the Cloudian HyperStore when needed. SmartStore & HyperStore provide Application and Data Aware Caching. * Caching is based on data age, priority and access patterns. * Bringing in data on-demand from Cloudian HyperStore to indexers. * Recently accessed data will be in cache until it meets the tiering policy. * Critical indexes can be configured to keep data in the cache longer. * Cache manager evicts based on LRU, data age/priority and loads active dataset on indexers. Immediate Benefits realised by deploying SmartStore on Cloudian. 1. Lower TCO. Decouple compute and storage. Scale storage for longer retention and indexers on performance demand. Reduce indexer footprint for warm/cold data. 2. Performance and Scale. Brings in data closer to compute on-demand. application and data aware cache. cache data based on age, priority and access patterns. 3. Faster Failure recovery. Copies of data and protection are offloaded to remote storage, recovery and rebalance are faster. 4. Per index enabled. SmartStore & Cloudian Benefits. 1. Scalability and high availability. 2. 75% TCO reduction. 3. Simplified management.