Deployment Architecture

multi site splunk deployment

sabaKhadivi
Path Finder

what is the suitable solution in the situation of 3 data center with huge amount of recieved logs without need to replicate logs ,

1. one heavy forwarder per each datacenter, 2-3 indexer and one search head per data center
2. one heavy forwarder for all sites, 2-3 indexer per data center, 1 search head per data center?
3. one heavy forwarder per datacenter, 2-3 indexer per data center, 1 search head totally for 3 data centers.
and is there any need to cluster search heads if having 3 search head is a good way?

Tags (1)
0 Karma

sabaKhadivi
Path Finder

@BainM what about locating all indexers and a search head in one site??,what about the time all indexers and a search head licated in a site?@BainM

0 Karma

BainM
Communicator

You would then have to contend with network traffic if your customers need to search the other 2 sites.
Local indexers and HF's at each site is best, in my humble opinion.

0 Karma

BainM
Communicator

Scenario #1 with clustered searchheads if you want customer and admin convenience. If SH's are located in each DC, however, make sure your network connection is consistently within 60-100ms ICMP transit. Otherwise, just use separate searchheads as you suggest, if this is not an inconvenience for customers.

Consider scenario #3 only if using a very beefy searchhead; as this one is a much higher risk.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...