https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465815#M6942 <P>Hello Experts,</P> <P>Checking if we can plan and implement splunk itsi (on a separate sh cluster) and splunk es(on a separate sh cluster) both pointing to same set of indexer cluster?<BR /> Please provide links if there's any available justifying above</P> Fri, 25 Oct 2019 01:24:06 GMT bishtk 2019-10-25T01:24:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465815#M6942 <P>Hello Experts,</P> <P>Checking if we can plan and implement splunk itsi (on a separate sh cluster) and splunk es(on a separate sh cluster) both pointing to same set of indexer cluster?<BR /> Please provide links if there's any available justifying above</P> Fri, 25 Oct 2019 01:24:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465815#M6942 bishtk 2019-10-25T01:24:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465816#M6943 <P>Hi.<BR /> We run both on a multisite index-cluster with 60 indexers without any issues.<BR /> ITSI runs on a search head cluster with 8 search head<BR /> ES runs on a ES search head cluster with 4 search heads.</P> Fri, 25 Oct 2019 07:52:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465816#M6943 broberg 2019-10-25T07:52:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465817#M6944 <P>Hi @broberg <BR /> Could you please also let me know the data volume per day in your environment is?</P> Fri, 25 Oct 2019 08:46:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465817#M6944 bishtk 2019-10-25T08:46:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465818#M6945 <P>We index about 6TB a day.<BR /> All log go trough Heavy forwarder before they reach the indexers, and we have just implemented some indexers on an other cluster on Google Cloud Platform aswell to make it easier to scale the environment.</P> Fri, 25 Oct 2019 09:05:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465818#M6945 broberg 2019-10-25T09:05:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465819#M6946 <P>Thank you @broberg </P> <P>So is there anything I need to take care wrt ES and ITSI on same multisite architecture apart from implementing/configuring them on separate searchhead cluster??</P> Fri, 25 Oct 2019 09:11:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465819#M6946 bishtk 2019-10-25T09:11:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465820#M6947 <P>Not what i can come up to at the moment i can talk to some colleages that did the ES implementation, but it was a long time ago. Just follow the documentation and im sure it will go smooth. </P> Fri, 25 Oct 2019 09:21:37 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465820#M6947 broberg 2019-10-25T09:21:37Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465821#M6948 <P>Thank you once again</P> Fri, 25 Oct 2019 10:16:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-itsi-and-splunk-enterprise-security-on-same-indexer/m-p/465821#M6948 bishtk 2019-10-25T10:16:52Z