topic Re: splunk cloud in Deployment Architecture

splunk cloud

trojan_81 — Fri, 30 Oct 2020 23:10:10 GMT

Hello all,

My organization is using splunk cloud. I log into splunk cloud to run searches and also access the enterprise security app from there as well.

Given the above statement, are the below statements correct?

1. Splunk cloud is doing these roles: indexer and search head

2. Splunk cloud is the same thing as splunk enterprise

Re: splunk cloud

gcusello — Sat, 31 Oct 2020 07:19:30 GMT

Hi @trojan_81,

about your assertions:

1. Splunk cloud is doing these roles: indexer and search head

Splunk roleas are always the same, but you don't see Indexers, only Search Heads; Indexers are used but they are outside of your control.

2. Splunk cloud is the same thing as splunk enterprise

If you're speaking of features, Splunk Cloud and Splunk Enterprise are more or less aligned.

if you're speaking of architecture, they are only a few different:

you don't access Indexers, only Search Heads,
for Splunk Cloud is a best practice to use at least two Heavy Forwarders as concentrators between your targets and Splunk, for Splunk Enterprise you don't need them.

In both cases, you need a Deployment Server and Universal Forwarders.

If you're speaking of data retention, in Splunk Cloud you have to deeply analyze your requirements because there are limitis in retention, instead in Splunk Enterprise retention depends only on available storage.

At least, if you're speaking of management, in Splunk Cloud you have an Indexer Cluster and a search Head Cluster that you don't need to manage and maintain and you haven't problems of resources and performaces, otherwise, in Splunk Enterprise you have to design, install, configure and maintain them.

Ciao.

Giuseppe

Re: splunk cloud

gcusello — Sat, 31 Oct 2020 17:53:24 GMT

Hi @trojan_81,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: splunk cloud

inventsekar — Sat, 31 Oct 2020 23:46:59 GMT

Hi @trojan_81 .. For future questioners, let me post this as a reference:

1. OnSplunk Docs page, tab 4 is the "Deploy", which gives lots of ideas for splunk design and deployment architectures

https://docs.splunk.com/Documentation/Splunk

2. Splunk training provides these 4 free courses -

https://www.splunk.com/en_us/training/free-courses/overview.html

Happy Splunking | Best Regards | Sekar | PS - Karma points appreciated!