Apeiron and Splunk

Splunk has proven that real-time decision making, based on machine generated data can add tremendous value to the business.  The ability to easily query data sets can provide insights simply not possible with manual processes.  As demand for this ability continues to grow, so does the infrastructure necessary to support it.  Splunk customers are now hitting a major barrier to their continued growth; infrastructure not capable of supporting real-time queries on massive data sets.  Performance, and more importantly budgets, cannot keep pace with the demand.  Apeiron has solved both of these problems with the ADS1000, Direct Scale-out Flash (DSF) platform.  Apeiron provides performance which is up to 14 times faster than traditional controller-based platforms, eliminates all external storage switching and provides a 70% reduction in physical footprint. 

Want to see how we do all of this?  Keep reading.

 

splunk

Do you need real-time data faster?

splunk_icon_2

Do you want faster insight?

splunk

Do you want to Splunk ALL your data?

Splunk faster than ever!

Real-time Security Information and Event Management (SIEM) on all the data ALL THE TIME!

Why Apeiron and Splunk?

Traditional controller based storage architectures were never designed to manage an environment such as Splunk.  The application is fully “storage aware” and does not require the latency inducing storage controllers typically deployed for legacy applications.  Splunk understands how to manage the movement of data between buckets, which means legacy systems must deploy multiple silos of disparate products to accommodate them.  Often times these systems require three different types of switching protocols in a single environment!  Because Splunk data can grow very quickly, legacy vendors must propose a hybrid solution consisting of flash arrays and traditional HDD systems networked together.  The user must then manually move data back and forth from HDDs and/or tape to flash when larger data sets are queried.  Another reason for this multi-tier design is a need to reduce infrastructure costs.  This need to keep the hardware costs “reasonable” further reduces the amount of data immediately at hand and forces longer SLA’s for real time reporting - and more importantly dramatically limits the amount of data which can be queried.

These overly complex storage solutions are simply a legacy of controller based storage architectures being force fit to modern scale-out applications.  Splunk has no need for additional storage computers or layers of storage switching.  These layers are simply an obstacle, slowing access to the storage.  Apeiron’s ADS1000 is a completely different approach to Splunk and all Big Data applications.  The Apeiron system leverages the fact that these applications already understand how to optimally manage the storage, all Splunk really needs is to “see” a single large pool of highly efficient storage.

The ADS1000 provides native NVMe access to thousands of SSDs.  Apeiron provides a single-scalable infrastructure, with 40GbE storage switching integrated directly in to each 2U enclosure.  This means there are no external switches to procure or manage.   Performance is equal to or better than captive/internally connected PCIe drives, which means a full NVMe network is imperceptible to the server environment.  When Splunk can address Petabytes of native NVMe SSDs, the application can provide real-time access to 100% of the data.  Apeiron eliminates the need for data migration between tiers of progressively slower legacy storage.

The ADS1000 was designed to leverage NVMe drives from any supplier, which means you can deploy the proper drive profile for the value of the data.  Today, Apeiron has tested and approved four suppliers with options up to 6.4TB per SSD.  Because our system does not require proprietary/custom drives of any sort, we can confidently offer the NVMe roadmap as well.  In the very near future, multiple suppliers will release 8 and 16TB NVMe drives, which equates to over 7.5 Petabytes in a single floor tile of Apeiron storage!  In addition to higher density drives, the performance roadmap is incredible as well.  3D XPoint technology™ from Intel promises to reduce SSD induced latency from 95 micro-seconds to below 7.  This will result in new definitions of what is possible in the world of Big Data analytics, and Apeiron is ready today.

Bonne++ is Splunk IO storage benchmark test
*Performance could be higher depending on deployment configuration

Benefits of Apeiron with Splunk

The benefits of having Apeiron as the underlying storage infrastructure to support a dynamically growing Splunk deployment are quite obvious:
splunk

14x faster reads

Search and index faster, support more concurrent users;

data analytics

All Data, All Real-Time, All the Time

Make decisions based on analysis of all your data, not a subset;

apeiron splunk icon

A single network protocol

Keep costs in check with simplified management and resource consolidation;
And deliver higher levels of predictable performance that seamlessly grow with your environment.