SwiftStack integrates with Splunk Enterprise

SwiftStack’s largest customers, spanning many industries, use our storage technology in a highly similar fashion. They have applications and devices that generate reams of data which lands on SwiftStack and is run through multiple sets of analyses to produce a meaningful business result. Pharmaceutical companies use SwiftStack to create more potent compounds. Manufacturers use SwiftStack to hone machine learning algorithms. Financial services firms use SwiftStack to identify low-risk borrowers. And, so on…

“The world’s most valuable resource is no longer oil, but data.”

The Economist, May 2017

This practice of ingesting large volumes of data and feeding it into high-powered compute engines exploits the high throughput rates of SwiftStack storage, measured in gigabytes per second. However, organizations not only ingest and process data, they also retain it for long periods of time. Why? As a Systems Architect who led the SwiftStack deployment at a Fortune 100 firm stated simply, “the more data we have, the better decisions we can make”. Long-term data retention is where the scale-out nature of SwiftStack comes into play — delivering lower cost at scale, higher data durability at scale, and simplified management at scale.

Doing More With Splunk Data…For Less

An “ingest/analyze/retain” workflow commonly found in IT shops is Splunk. Organizations use Splunk to derive insights from their data across IT Operations, Enterprise Security, and various Lines of Business. With Splunk’s undeniable value, users and business units are continuously pushing to expand Splunk usage and keep data longer for deeper analysis. The often-heard roadblock to wider Splunk use has been the cost and complexity of the underlying infrastructure, including a tight coupling between compute and storage which restricts IT flexibility.

This barrier has now been removed through a Splunk innovation called SmartStore.

Announced at Splunk’s annual user conference, .conf18, Splunk Enterprise with SmartStore is designed to reduce the costs of a Splunk infrastructure without impacting search performance. SwiftStack has been working with Splunk for many months in the pre-release phase, which has led to SwiftStack being fully compatible with a SmartStore-enabled Splunk environment. Additionally, SwiftStack’s load testing has confirmed Splunk’s goals for SmartStore: search performance stays within acceptable bounds across a wide array of scenarios.

SmartStore attaches Splunk Indexers to SwiftStack through the S3 API, and, in doing so, creates distinct compute and storage tiers that can each be scaled independently.

SwiftStack offers hardware freedom of choice, but the software runs best on the Cisco UCS family of Storage Servers.

SmartStore places the vast majority of Splunk data — 80% to 90%+, on average — on SwiftStack storage built with low $/TB SATA or SAS disk drives, driving down costs. SwiftStack protects Splunk data by storing it in multiple locations — across drives, servers, and sites — leveraging all system components under management. Finally, Splunk’s algorithms, ie, “the smarts within SmartStore”, interface with SwiftStack to make sure the frequently-accessed data is ready in the Indexer’s SSD-based cache when a search is performed, keeping service levels high.

SmartStore is more than just a feature; it is a significant advancement of Splunk’s data management model that leads to optimized compute and storage configurations. IT will spend less money building and less time managing their Splunk infrastructure, while Splunk users will continue to enjoy superior responsiveness as they crunch data sets for business and operational intelligence. Further, SwiftStack’s scale-out, high-throughput design amplifies all of SmartStore’s benefits.

Wins for Splunk Stakeholders
delivered by SmartStore and SwiftStack


 Splunk Users

 IT Infrastructure

 – Expand Splunk usage
– Retain Splunk data longer
– Achieve fast search performance
 – Ensure high data resiliency
– Scale storage in a modular way
– Simplify storage administration


Even though it’s not listed on the balance sheet, many organizations view data as their most valuable asset class. Tools like Splunk Enterprise play a major role in increasing the return on these data assets, as measured by the impact on a business’s profitability and competitiveness.  And, when SmartStore and SwiftStack are in place, more and more organizations will be making statements similar to the one we referenced earlier, “the more Splunk data we have, the better decisions we can make”.

About Author

Greg Govatos

Greg Govatos

Greg Govatos is the VP of Strategic Partnerships for SwiftStack.