Question for splunk architecture

[kevinsteeee]

Hi,

I have plan to install Splunk Enterprise SIEM in the cyber security operation center, and universal forwarder will be installed on each workstation in order to transmit windows event log.

From what I studied at the splunk site, it seems that I can design Architecture 1 or 2 as shown in the picture below.

I would like to know the pros and cons of using a heavy forwarder because I need to purchase an additional server to install Heavy Forwarder.

Also, I want to get technical support for purchase from korea engineer.

Could you please give me email address for technical support? I could not find email address about korea engineer in splunk website. 

Best regards,

[jotne]

Version 1 is ok if you need to do some with data before data get to the index, or for some reason client do not have directly connect with index server.

We do use version 1 since we have multiple customers that we store in different indexer.  Eks customer x sends data to syslog, the heavy forwarder change index name from index=syslog to index=x-syslog, and for customer y to index=y-syslog.  We know then that the data are separated within out Splunk solution.

Version 2 need less server and are ok if you can write directly to the indexer and do not need to change/trim data before it enters the index.

[richgalloway]

Architecture 1 rarely makes sense.  The heavy forwarder is a bottleneck, a single point of failure, adds traffic to the network, creates management and troubleshooting complexity, and can lead to data that is not well-balanced among indexers.  Architecture 2 avoids all of those problems.

[jotne]

single point of failure,

Not directly true.  There are noe problem having more than one HF.

We do use HF to overcome security issue and filtering before data reach index server.

[gcusello]

Hi @kevinsteeee,

I agree with @richgalloway,. the second architecture is better than the first for the reasons he described.

There's only one situation where the first is better: when you don't want to open all the routes between servers with UF and Indexer e.g. for security reasons: in this case the solution is the first but using two Heavy Forwarders to avoid a bottleneck and a Single Point of Failure.

If you don't have this requirement, use your second!

Ciao.

Giuseppe