Deployment Architecture

UF parallelization for Splunk Cloud

X_Kinkead
Explorer

I'm looking for advice for avoiding the 'Funnel Effect' for a small number of intermediate Universal Forwarders to about 15 cloud indexers - my best lead is to apply parallelization - has anyone had success with that, specifically to the Cloud version?  Are there alternatives?  

Here is a presentation on that issue, where the problem is described at depth but the parallelization solution is only briefly touched upon:

Video - https://www.splunk.com/en_us/resources/videos/worst-practices-and-how-to-fix-them.html
Presentation - https://conf.splunk.com/files/2017/slides/worst-practicesand-how-to-fix-them.pdf

Thanks for any advice!

Labels (1)
0 Karma

X_Kinkead
Explorer

It turns out that there was a change in corporate policy which allows for each of these systems to access the 'outside' network segment, provided a business need could be given, so I'm good to go - thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

My advice and (IMO) the best way to avoid the Funnel Effect is to eliminate intermediate forwarders.  Usually, they're unnecessary.  UFs should be sending directly to the cloud indexers.  The network team may complain about too many firewall rules, but that's often just laziness.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...