Hi Team,
We have a requirement where we need to deploy Splunk Solution only for Log management purpose (less 50 GB per day). We are planning to have two heavy log forwarder (one in primary and one in DR) which will take the feed from different log sources (Devices (Syslog) and Servers (UF)). The HLF will send the data to indexers for storage (one in each DC) through Network Load balancer to maintain the HA. Also, will send the data to another SIEM solution for correlation and monitoring purpose.
Is there any way that we can installed the Splunk in non-clustered mode with minimum overhead and making sure that we have all the logs as per the Log management requirement.
... View more