Deployment Architecture

Splunk-based aggregation tier?

woodcock
Esteemed Legend

Client desires a physical aggregation point on the way into Azure where the real indexers will be. I guess this is for splitting some data to different clusters. Nothing needs to be written or searchable there so no disk IO concerns but gobs of port I/O. What Splunk configuration would you use for this? I am assuming Indexer, built like the main indexer tier but with no special disk concerns, but I have never done anything like this so I am unsure. What would/did you do?

0 Karma

jconger
Splunk Employee
Splunk Employee

One or more intermediate forwarders would do the trick. Here is some documentation (it is for Splunk Cloud, but the concept is the same) -> http://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Configureanintermediateforwarder

Does this client have an existing Splunk environment on-premises and moving indexing to Azure? If so, how are they sending data to the indexer(s) today - universal forwarder, TCP, UDP, HTTP, something else? These methods are still viable with the indexing tier in Azure as long as the network connectivity is there. Perhaps the client wants to set some network rules to only allow inbound to the indexers in Azure from certain machines?

0 Karma

adonio
Ultra Champion

are you asking for an Intermediate Forwarder or Heavy Forwarder machine specs?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...