Components of splunk architecture with its function

[CryoHydra]

In our SIEM team meeting had discussion like we have100+ splunk servers ?

What does splunk server mean ? is it Splunk index alone or including heavy forwarders, deployment servers and search head ?

It would be great to have list of components associated with splunk architecture and its functions with use case?

[ChrisG]

I also highly recommend:

• The free Splunk Infrastructure Overview e-learning class
• The entire Distributed Deployment Manual

[skoelpin]

Here's a simple example of the Splunk distributed architecture. Your SIEM team was most likely talking about indexers and/or search heads. You typically cluster these servers for HA purposes and always add more indexers before adding search heads

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Aboutindexesandindexers#Indexers

[niketn]

Also refer to Splunk Validated Architecture if this is in inception phase: https://www.splunk.com/pdfs/white-papers/splunk-validated-architectures.pdf

[CryoHydra]

Thank you !!!

[FrankVl]

And what exactly is your question here? If anyone knows which components you have, how many of each and what role they play, it would be you?

[CryoHydra]

Sorry i am from analyst team.

[FrankVl]

I meant ‘you’ in the broad sense of the word, not you personally.

This sounds to me like a question for the person/team in your company who administers this Splunk environment.

But perhaps I misunderstood your question.