How can we onboard lots of data while maintaining cluster stability?

[ddrillic]

Quite often we onboard new clients with new data loads, which is a one-time scenario for this customer. During these periods when the initial data is being onboarded, we would like to disturb the Splunk clusters as little as possible and we don't mind if the process of onboarding the data takes an hour or two more than the normal time to upload such amount of data.

What is available for us to achieve it?

[damiensurat]

The only way to handle this is based on scenario and market demand as well as organization impact and alignment to your Splunking requirements and funding. I would create an on boarding process which answers questions such as use case, impact to organizational needs as well as data capacities and performance requirements. Basically, does the onboardong of a new client help to allow your team to market the new onboarded client and showcase the capabilities of Splunk in a way that it was worth the cost of licensing as well as infrastructure. As you onboard new clients, in order to maintain stability, you will need to have to scale either horizontally or vertically. It all comes down to the cost assement of return on investment.