Deployment Architecture

Splunk DS behaving abnormal due to more clients reporting.

inayath_khanin
Explorer

Hi Folks,

 

We have 40k+ clients reporting to one DS due to which we see a performance degradation on Splunk DS. As Per best practice i see we should not have more than 10K clients reporting to one DS. Please suggest a way forward on this.

Do we need to have one more seperate DS and divide half of the clients or any specific solution in this scenario?

 

Thanks 

Labels (1)
0 Karma

Splunk20
Loves-to-Learn Lots

Check if the current installation works optimally by changing polling interval where size and rate of new/change applications being installed on forwarders will be key drivers.

Else you can scale your DS and should ensure all DS have same set of configurations. The choices are horizontal vs tiered approach, which will also determine the serverclass.conf attribute like stateOnClient for the apps for intermittent DS and forwarders. Other attributes to ensure for scaled DS are whitelisting forwardes based on apps that will be deployed /not deployed along need to report back with stateOnClient = enabled / noop

For horizontal scaling introducing load balancer is a good approach.


https://www.splunk.com/en_us/blog/tips-and-tricks/universal-or-heavy-that-is-the-question.html

0 Karma

harsmarvania57
Ultra Champion

Hi,

 

Have a look at conf session https://conf.splunk.com/files/2019/slides/FN2048.pdf about Multi-Deployment Server

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...