You can enable hardware snapshots and select the snapshot engine for a Splunk cluster.
Note: On Linux platforms, by default, the default subclient uses the IntelliSnap Native engine (Logical Volume Manager (LVM) snapshots) for the snapshot operations. For Linux LVM snaps, there must be adequate free space in the LVM volume group for snapshot creation. The default COW cache size is set to 4096 MB or 5% of the volume size, whichever is greater.
From the navigation pane, go to Protect > Big data.
The Apps page appears.
In the Name column, click the cluster that you want to enable hardware snapshots for.
The cluster page appears.
Under Subclients, click default.
The default page appears.
On the Configuration tab, in the Snapshot management section, move the Enable hardware snapshot toggle key to the right.
The Snapshot management dialog box appears.
From the Engine list, select the Snapshot engine to use.
By default, native snapshot engine is configured for Splunk backup. Verify that the logical volume manager is configured on the Splunk data paths.
If you select a hardware engine, disable the lvmetad service on the indexer peer nodes.