Deployment Architecture

Components of splunk architecture with its function

CryoHydra
Path Finder

In our SIEM team meeting had discussion like we have100+ splunk servers ?

What does splunk server mean ? is it Splunk index alone or including heavy forwarders, deployment servers and search head ?

It would be great to have list of components associated with splunk architecture and its functions with use case?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

skoelpin
SplunkTrust
SplunkTrust

Here's a simple example of the Splunk distributed architecture. Your SIEM team was most likely talking about indexers and/or search heads. You typically cluster these servers for HA purposes and always add more indexers before adding search heads

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Aboutindexesandindexers#Indexers

niketn
Legend

Also refer to Splunk Validated Architecture if this is in inception phase: https://www.splunk.com/pdfs/white-papers/splunk-validated-architectures.pdf

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

CryoHydra
Path Finder

Thank you !!!

0 Karma

FrankVl
Ultra Champion

And what exactly is your question here? If anyone knows which components you have, how many of each and what role they play, it would be you?

0 Karma

CryoHydra
Path Finder

Sorry i am from analyst team.

0 Karma

FrankVl
Ultra Champion

I meant ‘you’ in the broad sense of the word, not you personally.

This sounds to me like a question for the person/team in your company who administers this Splunk environment.

But perhaps I misunderstood your question.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...