Deployment Architecture

What is the best practice for organizing indexes for multiple environments of an application such as dev, QA, and prod?

tjj9309
Engager

What is the best practice for organizing indexes for multiple environments of an application such as dev/qa/prod? Is it best to separate them all out into their own index or use a single index?

Thank you

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

The decision can be determined by answering multiple questions:

  1. Is the data going to be queried simultaneously? That is, will you ever need to search for dev/prod at the same time (in the same query)? If no, you can separate the data by env.
  2. Are different sets of users going to require access to different indexes? If so, yes, you should separate the data into separate indexes.
  3. Are you managing a high volume of data? Then yes, separating into separate indexes may provide you with better search performance particularly if you are only searching one env at a time.

Ultimately, it is up to you. The data (most likely) will have inherent features that separate it, either by host, source or sourcetype so, while a separate index is not required, consider the other benefits of separating your data.

View solution in original post

woodcock
Esteemed Legend

Generally it is FAR easier to join together prior to launching than it is to separate afterwards when it becomes necessary for some unforeseen reason so I always suggest we separate on an index-level and also use tags or eventtypes to provide automatic delineation when more than 1 index is used in a combined search.

0 Karma

the_wolverine
Champion

The decision can be determined by answering multiple questions:

  1. Is the data going to be queried simultaneously? That is, will you ever need to search for dev/prod at the same time (in the same query)? If no, you can separate the data by env.
  2. Are different sets of users going to require access to different indexes? If so, yes, you should separate the data into separate indexes.
  3. Are you managing a high volume of data? Then yes, separating into separate indexes may provide you with better search performance particularly if you are only searching one env at a time.

Ultimately, it is up to you. The data (most likely) will have inherent features that separate it, either by host, source or sourcetype so, while a separate index is not required, consider the other benefits of separating your data.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...