Deployment Architecture

Components of splunk architecture with its function

CryoHydra
Path Finder

In our SIEM team meeting had discussion like we have100+ splunk servers ?

What does splunk server mean ? is it Splunk index alone or including heavy forwarders, deployment servers and search head ?

It would be great to have list of components associated with splunk architecture and its functions with use case?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

skoelpin
SplunkTrust
SplunkTrust

Here's a simple example of the Splunk distributed architecture. Your SIEM team was most likely talking about indexers and/or search heads. You typically cluster these servers for HA purposes and always add more indexers before adding search heads

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Aboutindexesandindexers#Indexers

niketn
Legend

Also refer to Splunk Validated Architecture if this is in inception phase: https://www.splunk.com/pdfs/white-papers/splunk-validated-architectures.pdf

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

CryoHydra
Path Finder

Thank you !!!

0 Karma

FrankVl
Ultra Champion

And what exactly is your question here? If anyone knows which components you have, how many of each and what role they play, it would be you?

0 Karma

CryoHydra
Path Finder

Sorry i am from analyst team.

0 Karma

FrankVl
Ultra Champion

I meant ‘you’ in the broad sense of the word, not you personally.

This sounds to me like a question for the person/team in your company who administers this Splunk environment.

But perhaps I misunderstood your question.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...