Gemini Enterprise: Manage includes storage features which allow administrators to monitor the physical hard drives and mount NFS, CIFS, S3, and DAS (Direct Attached Storage) volumes to extend the capacity of Splunk storage and allow for reading files from network storage.

This allows the volume of an existing system to be extended and the mount point for Splunk indexes may also be defined.

To access the Storage feature

  1. Log in to Gemini Enterprise: Manage.
  2. Select Node.
  3. Choose Storage.
  4. Select the storage option you’d like to use.

NFS Mount

Defining an NFS Mount Point

  1. Select NFS.
  2. Select + Add NFS Mount Point.
  3. Enter the local mount point (located at /opt/sbox/data folder).
  4. Enter the IP address of the remote server.
  5. Enter the remote path (starting with a leading /).
  6. Select the mount type. Hard mount is recommended by Splunk when the mount point is used for cold buckets.
  7. Select NFS version. This must match the version of NFS server.
  8. Choose Add to add the new NFS mount.

A mount point will not be detected and validated until you enable the configuration by selecting Mount. Once enabled, Gemini Enterprise: Manage will automatically mount the NFS Mount Point upon boot.

CIFS Mount

Defining a CIFS Mount Point

  1. Select CIFS.
  2. Select + Add CIFS Mount Point.
  3. Enter the local mount point (located at /opt/sbox/data folder)
  4. Enter the IP address of the remote server
  5. Enter the remote folder (starting with a leading /)
  6. Enter the Username.
  7. Enter the Password.
  8. Choose Add to add the new CIFS mount.

A mount point will not be detected and validated until you enable the configuration. When enabled, Gemini Enterprise: Manage will automatically mount the CIFS Mount Point upon boot.

S3 Mount

Defining an Amazon S3 Bucket

  1. Select S3.
  2. Select + Add S3 Bucket.
  3. Enter the your Amazon S3 bucket name. The local mount point will automatically point to the /opt/sbox/data/s3/ folder.
  4. Enter the IAM Access Key ID.
  5. Enter the IAM Secret Access Key.
  6. If you want all the data stored in the S3 bucket to be encrypted, Enable Server-Side Encryption (SSE) and select the appropriate key option.

To get your Amazon S3 credentials, see Managing Access Keys for IAM Users. Please note that access to Amazon S3 storage requires a connection to the public internet from the node.

Amazon S3 is designed for data archiving and is not applicable to Splunk indexing. Specifying hot/warm/cold buckets to S3 mount points will cause Splunk malfunctions.

iSCSI Target

Adding an iSCSI target

Before adding an iSCSI target, contact your NAS administrator to get the iSCSI target information and CHAP credentials.

  1. Select ISCSI.
  2. Select the pencil icon to open Initiator Settings.
  3. Enter an Initiator Name.
  4. Specify the Login CHAP and Discovery CHAP. This must match to the settings on the iSCSI target.
  5. Choose Save.

In the Target Discovery field, enter the iSCSI target IP address and port, e.g. 192.168.1.100:3260. The default discovery port is 3260/tcp. Discovered iSCSI targets are returned in a list. Select Login to connect to the iSCSI target.

Once connected, a new block device is detected and listed in the Undefined Storage tab. Note that a connected iSCSI target only indicates that there are new block devices available - please ensure that you mount them in Undefined Storage.

Set the MTU to a value larger than 1,500 to enable Jumbo Frame for the ethernet interface used for the iSCSI connection. This will improve iSCSI performance. Consult your NAS vendor for more details.