topic Re: Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure? in Getting Data In

Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure?

horsefez — Mon, 14 Dec 2015 10:26:22 GMT

Hi,

My company is deciding to use Splunk in a Small Enterprise Deployment.
I already read a bit about scaling, the infrastructure design, and the amount of components.

I'm assigned the task to think about and design our deployment.
So.... I want to ask if my thoughts so far make any sense.

My plan is to build an infrastructure that looks like the attached picture.

I would use a Heavy Forwarder in the deployment to filter data that is coming into the deployment before it gets indexed. I might not need this feature today, but maybe later.

Is this a legit deployment?
Is it ok if I configure the Universal Forwarders to send data to the HF first?

Re: Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure?

javiergn — Mon, 14 Dec 2015 15:09:53 GMT

Your design looks all right to me but there are lots of other things you need to consider, such as:

Number of final users (this will increase the load on search heads and therefore indexers)
Data you are ingesting every day
Resiliency: if your SH is down you are blind so what's your DR plan here? Same goes for the HF
Physical location of your data
etc

If your budget is limited and assuming you are indexing less than 200GB/day I would do the following:

Get rid of the HF. Your indexers can do the filtering too and they also provide resiliency. Your HF is a unique point of failure in your diagram
Go for a virtual Search Head (make sure you allocate enough CPU cores and memory) and use your virtual infrastructure to provide backup and DR for this component

Hope that helps.

Thanks,
J

Re: Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure?

javiergn — Mon, 14 Dec 2015 15:15:41 GMT

Other concepts you might want to read about:

search head clustering
multisite indexer clustering
deployment server

This is all documented here, here and here.

Re: Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure?

hylam — Tue, 15 Dec 2015 02:41:38 GMT

http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Forwarderdeploymenttopologies
http://docs.splunk.com/Documentation/Splunk/6.3.1/Deploy/Searchheadwithindexers
http://docs.splunk.com/Documentation/Splunk/6.3.1/Deploy/SHCwithindexers

Re: Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure?

horsefez — Wed, 16 Dec 2015 13:24:52 GMT

Thank you all! 🙂

Re: Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure?

horsefez — Wed, 16 Dec 2015 13:31:57 GMT

Is it a viable strategy to buy an ESX-Server and run all the components on a virtual server infrastructure?

Re: Is my current architectural design a legitimate deployment for a small Splunk Enterprise infrastructure?

hylam — Wed, 16 Dec 2015 13:33:55 GMT

yes

https://www.splunk.com/content/dam/splunk2/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf

https://answers.splunk.com/answers/298/can-i-run-splunk-in-a-vm-are-there-any-issues-or-tricks-i-should-be-aware-of.html