Archive

Main differences between Splunk Enterprise and Splunk Cloud

Communicator

Currently we have an all On-Prem Splunk enterprise environment. From an administration perspective what is the differences if we move to a Splunk Cloud environment. What will be the differences in managing the deployment of apps? Any and all information is welcome. Thank you.

0 Karma

Ultra Champion

I think some of the URLs have moved over time. So here's their location as of today:

Splunk Employee
Splunk Employee
0 Karma

Splunk Employee
Splunk Employee

The Splunk Cloud documentation also provides a more detailed comparison of Splunk Cloud and Splunk Enterprise: http://docs.splunk.com/Documentation/SplunkCloud/6.4.1/User/Overview.

SplunkTrust
SplunkTrust

I am not a Cloud user, but did investigate moving in that direction. The key difference between Enterprise and Cloud is you have no control over the underlying infrastructure with Cloud. You can install and manage apps using the familiar GUI, but any changes to the platform (permissions changes, program installation, etc.) are done by Splunk support via a ticket.

As with any cloud service, there are also security considerations - that is, can Splunk Cloud still access all of your on-premises data sources.

---
If this reply helps you, an upvote would be appreciated.

Splunk Employee
Splunk Employee

You will be sending the data to the splunkcloud deployment using a splunk forwarder installed on your on-prem servers. So you not need to open your inbound access, only outbound ports to send data to the cloud servers.,

Exceptions :
- if you have an app that uses a script to collect logs remotely using an API (ldap search, db connect, or AWS S3 monitoring by example), then the inputs collector may be on the cloud instance, and may require some firewall work.

0 Karma