Splunk Enterprise Security

Enterprise Security 6.x Multisite Search head Cluster

danan5
Path Finder

Hi,

Does anyone happen to know if Multisite search head clustering is suppported in ES 6.x? The validated architectures document says not, but it was written in 2018. Reading the release notes of 6.0, 6.0.1 and 6.1 it sounds like there have been ajustments to the way it handles SHC knowledge objects but I don't know if this changes the advice from the validated design docs.

"a single dedicated search head cluster contained within a siteis required to deploy the app . ES requires a consistent set of runtime artifacts to be available and this cannot be guaranteed in a stretched SHC when a site outage occurs. To be able to recover an ES SH environment from a site failure, 3rd party technology can be used to perform a failover ofthe search head instances, or a "warm standby" ES SH can be provisioned and kept in synch with the primary ES environment.

Regards,
David

0 Karma

nickhills
Ultra Champion

ES can be run on a single site SHC but it is notoriously difficult to a.) get working properly b.) keep working. (Let alone MultiSite)

If you are determined to run ES on SHC you would be highly advised to engage Splunk Professional Services.
They will probably tell you the same thing, but will happily take your money 🙂

There are compelling reasons why you might want to run ES on SHC, and some companies have had great success with it, but this is one to seek some expert on site help with.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...