Deployment Architecture

Splunk SmartStore for Single Site Indexer Cluster spanning across two AWS Regions

sosusa
Engager

Can Splunk SmartStore enabled with single site Indexer clustering which is spanning across two AWS regions?  Ex: One set of Indexer Cluster located in AWS Region A and another Set of Indexer Cluster sitting in Region B, Can one s3  Remote Object Store used with all Indexers from both Clusters?  Thanks.

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

I don't see why not. From Splunk's perspective it's just a remote storage regardless of where the indexers are. As long as you have network connectivity you should be fine.

I suppose it might cost you more if you have inter-region traffic instead if intra-region one but I'm not that good on AWS pricing to say somethig definite here. And it's an issue completely outside of Splunk.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

I don't see why not. From Splunk's perspective it's just a remote storage regardless of where the indexers are. As long as you have network connectivity you should be fine.

I suppose it might cost you more if you have inter-region traffic instead if intra-region one but I'm not that good on AWS pricing to say somethig definite here. And it's an issue completely outside of Splunk.

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...