Deployment Architecture

multi site splunk deployment

sabaKhadivi
Path Finder

what is the suitable solution in the situation of 3 data center with huge amount of recieved logs without need to replicate logs ,

1. one heavy forwarder per each datacenter, 2-3 indexer and one search head per data center
2. one heavy forwarder for all sites, 2-3 indexer per data center, 1 search head per data center?
3. one heavy forwarder per datacenter, 2-3 indexer per data center, 1 search head totally for 3 data centers.
and is there any need to cluster search heads if having 3 search head is a good way?

Tags (1)
0 Karma

sabaKhadivi
Path Finder

@BainM what about locating all indexers and a search head in one site??,what about the time all indexers and a search head licated in a site?@BainM

0 Karma

BainM
Communicator

You would then have to contend with network traffic if your customers need to search the other 2 sites.
Local indexers and HF's at each site is best, in my humble opinion.

0 Karma

BainM
Communicator

Scenario #1 with clustered searchheads if you want customer and admin convenience. If SH's are located in each DC, however, make sure your network connection is consistently within 60-100ms ICMP transit. Otherwise, just use separate searchheads as you suggest, if this is not an inconvenience for customers.

Consider scenario #3 only if using a very beefy searchhead; as this one is a much higher risk.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...