Deployment Architecture

splunk cloud

trojan_81
Path Finder

Hello all,

My organization is using splunk cloud.  I log into splunk cloud to run searches and also access the enterprise security app from there as well.

Given the above statement, are the below statements correct?

1. Splunk cloud is doing these roles:  indexer and search head

2. Splunk cloud is the same thing as splunk enterprise

 

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @trojan_81,

about your assertions:

1. Splunk cloud is doing these roles:  indexer and search head

Splunk roleas are always the same, but you don't see Indexers, only Search Heads; Indexers are used but they are outside of your control.

2. Splunk cloud is the same thing as splunk enterprise

If you're speaking of features, Splunk Cloud and Splunk Enterprise are more or less aligned.

if you're speaking of architecture, they are only a few different:

  • you don't access Indexers, only Search Heads,
  • for Splunk Cloud is a best practice to use at least two Heavy Forwarders as concentrators between your targets and Splunk, for Splunk Enterprise you don't need them.

In both cases, you need a Deployment Server and Universal Forwarders.

If you're speaking of data retention, in Splunk Cloud you have to deeply analyze your requirements because there are limitis in retention, instead in Splunk Enterprise retention depends only on available storage.

At least, if you're speaking of management, in Splunk Cloud you have an Indexer Cluster and a search Head Cluster that you don't need to manage and maintain and you haven't problems of resources and performaces, otherwise, in Splunk Enterprise you have to design, install, configure and maintain them.

Ciao.

Giuseppe

View solution in original post

inventsekar
Ultra Champion

Hi @trojan_81 .. For future questioners, let me post this as a reference:

1. OnSplunk Docs page, tab 4 is the "Deploy", which gives lots of ideas for splunk design and deployment architectures

https://docs.splunk.com/Documentation/Splunk

2. Splunk training provides these 4 free courses - 

https://www.splunk.com/en_us/training/free-courses/overview.html

 

Happy Splunking | Best Regards | Sekar | PS - Karma points appreciated!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @trojan_81,

about your assertions:

1. Splunk cloud is doing these roles:  indexer and search head

Splunk roleas are always the same, but you don't see Indexers, only Search Heads; Indexers are used but they are outside of your control.

2. Splunk cloud is the same thing as splunk enterprise

If you're speaking of features, Splunk Cloud and Splunk Enterprise are more or less aligned.

if you're speaking of architecture, they are only a few different:

  • you don't access Indexers, only Search Heads,
  • for Splunk Cloud is a best practice to use at least two Heavy Forwarders as concentrators between your targets and Splunk, for Splunk Enterprise you don't need them.

In both cases, you need a Deployment Server and Universal Forwarders.

If you're speaking of data retention, in Splunk Cloud you have to deeply analyze your requirements because there are limitis in retention, instead in Splunk Enterprise retention depends only on available storage.

At least, if you're speaking of management, in Splunk Cloud you have an Indexer Cluster and a search Head Cluster that you don't need to manage and maintain and you haven't problems of resources and performaces, otherwise, in Splunk Enterprise you have to design, install, configure and maintain them.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @trojan_81,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...