Deployment Architecture

Splunk Orchestration, aka Manage Distributed Deployment from A to Z

theunf
Communicator

We´re researching for solutions to offer Splunk as an internal cloud solution thru all different and disperse areas of a client where an internal client could connect to a dashboard and create apps, users, indexes and start the input of multiple data sources.

This global managing solution would distribute the tasks among each role, so apps and users goes to the search head pooling/cluster, indexes goes to master cluster node or individually indexers (besides the best splunk practice suggests to create each index on all roles) and the data inputs to deployment server or directly to heavy/universal forwarders.

Does anyone experiencing Orchestration tools as from IBM or Cisco to manage the hole picture : servers, storage and all Splunk roles ?

Ricapar
Communicator

I don't have a answer with specific products for this, but I do have some general ideas. I am also currently trying to tackle this problem.

  • Find an orchestration tool that is capable of calling REST APIs and ingesting XML or JSON. Use this against Splunk's REST APIs, which are fairly well documented.
  • Use source control - store all your configs in git in a central repository, and have automated scripts to pull down the appropriate configs to the respective clients.

Right now I'm using a hacked-up shell script to dynamically create apps/roles/indexes when onboarding new users using the REST API. This can be heavily improved with the use of an actual self-service type catalog that calls a workflow engine.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...