Splunk POD core concepts

How Splunk POD works

Splunk POD uses the Splunk Operator for Kubernetes (SOK) to deploy Splunk Enterprise in a Kubernetes cluster. The deployment comprises 3 software layers running on pre-validated Cisco UCS hardware:

• Kubernetes: The container orchestration layer.
• Splunk Operator for Kubernetes (SOK): Automates Splunk Enterprise deployment and management.
• Splunk Enterprise: The containerized software, including search heads, indexers, and management components.

Choose from 4 sizing options based on ingest volume requirements: Small, Medium, Large, or Extra-Large. For more information about sizing and components, see Splunk POD architecture.

Kubernetes Installer for Splunk POD

The Kubernetes Installer deploys the environment using a single ELF binary that contains all necessary components and OCI images. The installer automates the installation and management of the entire stack based on a static cluster configuration file (cluster-config.yaml). For installation instructions, see Deploy Splunk POD.

Scheduling and resiliency

Splunk POD lets Kubernetes freely schedule most pods across the cluster, so components can share hosts and use fewer nodes. Indexers are the exception, requiring host-level NVMe storage for performance.

The installer applies placement rules as soft constraints, so pods can still schedule during node failures, hardware changes, or emergency node replacement, even if hosts do not meet the expected placement criteria.

Placement Rules:

• Strict Separation (protected components): Indexer pods never co-locate with other indexer pods, and require nodes with the /mnt/splunk mountpoint.
• Flexible Placement (other components): Search heads and management components (cluster manager, license manager, deployer, and monitoring console) can co-locate with protected components if CPU and memory resources allow. Placement of these components can vary between cluster deployments.

For more information on node types and hardware, see Splunk POD architecture.

Tiered storage (SmartStore)

Splunk POD implements a storage framework that balances search performance and long-term data retention. Splunk SmartStore manages the movement of data between 2 storage tiers:

• Local cache: High-performance storage on indexer nodes for hot and warm data.
• Object store (Ceph): S3-compliant storage within the Kubernetes cluster that replicates data for resiliency.

This design separates the storage and compute tiers to prevent I/O contention. For details on the Splunk POD storage framework, see Splunk POD architecture.

Validated architectures

Splunk POD uses Splunk Validated Architectures (SVA) to ensure the environment meets established performance and reliability standards. This alignment provides a predictable environment based on Splunk best practices for enterprise scale. For more information, see Splunk Validated Architectures (SVA).