Deployment Architecture

How many gateways can be deployed for 5000 collectors?

Eshwar
Engager

Hi Community

Please suggest how many gateways can be deployed for 5000 collectors?

Labels (1)
0 Karma

Eshwar
Engager

Hi @gcusello ,

We are trying to replicate below architecture where in OTEL collector will be installed on target servers and all OTEL collectors will be pointed to Gateway server. So, we would like to know here that how many gateways are required.

https://docs.splunk.com/Observability/gdi/opentelemetry/deployment-modes.html#collector-gateway-mode

0 Karma

Eshwar
Engager

Hi @gcusello ,

My question is with respect to Splunk Observability Cloud. We have around 5000 client server to redirect gateway so please let us know how many gateways are required in this architecture and the capacity with respect to volume of data, how much data can process by gateway?

Regards,

Eshwar

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Eshwar,

ok, you're speking of Heavy Forwarders to use as concentrators to collect all the logs from your on-premise architecture to Splunk Observability Cloud.

The number of HFs depends on the following factors:

  • they must be at least 2 to avoid single points of failure,
  • how many GB you have to transfer daily and in the peak points,
  • if you demand to HFs some parsing activities (and usual this happens),
  • if you have only one exit point from your network to Splunk Observability Cloud,
  • i you have more segregated networks and you want to avoid to open the connections from them to the HFs or to Splunk Cloud.

The most important factor is the data volume, not the number of target servers: how many events you send to Splunk Observability Cloud in the Peak hours?

In my experience, I hint to start with two HFs, configurated with the correct hardware reference and the correct setup to avoid queues, then you can analyze the load on these servers and the presence of queue or delays in indexing.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Eshwar,

what do you mean with Gateway and Collector?

If you mean sgent for Gateway, in Splunk thay are called Universal Forwarders and they are installed one in each terget server.

The UFs can directly send their logs to Indexers or they can be concentrated in intermediate Heavy Forwarders (your Concentrators?) .

There's no licence for both the kinds of Forwarders, and you pay only for the daily indexed log volume.

For more infos you can download the "Splunk validated Architectres" doc (https://www.splunk.com/en_us/resources/splunk-validated-architectures.html?locale=en_us) or see at https://docs.splunk.com/Documentation/SVA/current/Architectures/Introduction .

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...