Splunk Enterprise Security

Enterprise Security 6.x Multisite Search head Cluster

danan5
Path Finder

Hi,

Does anyone happen to know if Multisite search head clustering is suppported in ES 6.x? The validated architectures document says not, but it was written in 2018. Reading the release notes of 6.0, 6.0.1 and 6.1 it sounds like there have been ajustments to the way it handles SHC knowledge objects but I don't know if this changes the advice from the validated design docs.

"a single dedicated search head cluster contained within a siteis required to deploy the app . ES requires a consistent set of runtime artifacts to be available and this cannot be guaranteed in a stretched SHC when a site outage occurs. To be able to recover an ES SH environment from a site failure, 3rd party technology can be used to perform a failover ofthe search head instances, or a "warm standby" ES SH can be provisioned and kept in synch with the primary ES environment.

Regards,
David

0 Karma

nickhills
Ultra Champion

ES can be run on a single site SHC but it is notoriously difficult to a.) get working properly b.) keep working. (Let alone MultiSite)

If you are determined to run ES on SHC you would be highly advised to engage Splunk Professional Services.
They will probably tell you the same thing, but will happily take your money 🙂

There are compelling reasons why you might want to run ES on SHC, and some companies have had great success with it, but this is one to seek some expert on site help with.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...