topic Components of splunk architecture with its function in Deployment Architecture

Components of splunk architecture with its function

CryoHydra — Sat, 02 Jun 2018 00:52:38 GMT

In our SIEM team meeting had discussion like we have100+ splunk servers ?

What does splunk server mean ? is it Splunk index alone or including heavy forwarders, deployment servers and search head ?

It would be great to have list of components associated with splunk architecture and its functions with use case?

Re: Components of splunk architecture with its function

FrankVl — Sat, 02 Jun 2018 01:15:03 GMT

And what exactly is your question here? If anyone knows which components you have, how many of each and what role they play, it would be you?

Re: Components of splunk architecture with its function

skoelpin — Sat, 02 Jun 2018 02:16:25 GMT

Here's a simple example of the Splunk distributed architecture. Your SIEM team was most likely talking about indexers and/or search heads. You typically cluster these servers for HA purposes and always add more indexers before adding search heads

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Aboutindexesandindexers#Indexers

Re: Components of splunk architecture with its function

CryoHydra — Sat, 02 Jun 2018 02:52:41 GMT

Sorry i am from analyst team.

Re: Components of splunk architecture with its function

FrankVl — Sat, 02 Jun 2018 06:04:57 GMT

I meant ‘you’ in the broad sense of the word, not you personally.

This sounds to me like a question for the person/team in your company who administers this Splunk environment.

But perhaps I misunderstood your question.

Re: Components of splunk architecture with its function

niketn — Sat, 02 Jun 2018 06:47:14 GMT

Also refer to Splunk Validated Architecture if this is in inception phase: https://www.splunk.com/pdfs/white-papers/splunk-validated-architectures.pdf

Re: Components of splunk architecture with its function

CryoHydra — Sat, 02 Jun 2018 12:24:00 GMT

Thank you !!!

Re: Components of splunk architecture with its function

ChrisG — Sat, 02 Jun 2018 15:17:46 GMT

I also highly recommend:

The free Splunk Infrastructure Overview e-learning class
The entire Distributed Deployment Manual