Distributed architecture

[icherif]

Hello Splunk members,

We would like to set up a SIEM for our clients. The architecture is :

• A SIEM Server hosted in our Datacenter
• SIEM Clients or SIEM child servers hosted in client's datacenter.
• Data coming from each client are independants
• Administration of SIEM clients is done from SIEM Server
• We could specify user per client ( so that this user can't see logs coming from other clients).

I am newbie in SPLUNK and i would know if it's possible to set up these functionnalities and how.

Thanks in advance.

[Ayn]

Yes, it's definitely possible to do this (we do pretty much exactly this ourselves). Describing how would take a long time and depends on more exact details of your scenario so it'd probably be better to raise this discussion with your sales rep / engineer or for that matter Splunk's professional services.

Depending on whether you're planning to use your central infrastructure to search and alert on things in your clients' environments you might run into some challenges with having Splunk treat different environments differently. For instance if you want to treat assets individually per client you need to find a solution that makes sure that you're not mixing assets from different environments.