Deployment Architecture

Components of splunk architecture with its function

CryoHydra
Path Finder

In our SIEM team meeting had discussion like we have100+ splunk servers ?

What does splunk server mean ? is it Splunk index alone or including heavy forwarders, deployment servers and search head ?

It would be great to have list of components associated with splunk architecture and its functions with use case?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

skoelpin
SplunkTrust
SplunkTrust

Here's a simple example of the Splunk distributed architecture. Your SIEM team was most likely talking about indexers and/or search heads. You typically cluster these servers for HA purposes and always add more indexers before adding search heads

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Aboutindexesandindexers#Indexers

niketn
Legend

Also refer to Splunk Validated Architecture if this is in inception phase: https://www.splunk.com/pdfs/white-papers/splunk-validated-architectures.pdf

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

CryoHydra
Path Finder

Thank you !!!

0 Karma

FrankVl
Ultra Champion

And what exactly is your question here? If anyone knows which components you have, how many of each and what role they play, it would be you?

0 Karma

CryoHydra
Path Finder

Sorry i am from analyst team.

0 Karma

FrankVl
Ultra Champion

I meant ‘you’ in the broad sense of the word, not you personally.

This sounds to me like a question for the person/team in your company who administers this Splunk environment.

But perhaps I misunderstood your question.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...