Archive

Components of splunk architecture with its function

Path Finder

In our SIEM team meeting had discussion like we have100+ splunk servers ?

What does splunk server mean ? is it Splunk index alone or including heavy forwarders, deployment servers and search head ?

It would be great to have list of components associated with splunk architecture and its functions with use case?

0 Karma

Splunk Employee
Splunk Employee

SplunkTrust
SplunkTrust

Here's a simple example of the Splunk distributed architecture. Your SIEM team was most likely talking about indexers and/or search heads. You typically cluster these servers for HA purposes and always add more indexers before adding search heads

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Aboutindexesandindexers#Indexers

Legend

Also refer to Splunk Validated Architecture if this is in inception phase: https://www.splunk.com/pdfs/white-papers/splunk-validated-architectures.pdf

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

Thank you !!!

0 Karma

Ultra Champion

And what exactly is your question here? If anyone knows which components you have, how many of each and what role they play, it would be you?

0 Karma

Path Finder

Sorry i am from analyst team.

0 Karma

Ultra Champion

I meant ‘you’ in the broad sense of the word, not you personally.

This sounds to me like a question for the person/team in your company who administers this Splunk environment.

But perhaps I misunderstood your question.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!