Deployment Architecture

splunk cloud

trojan_81
Path Finder

Hello all,

My organization is using splunk cloud.  I log into splunk cloud to run searches and also access the enterprise security app from there as well.

Given the above statement, are the below statements correct?

1. Splunk cloud is doing these roles:  indexer and search head

2. Splunk cloud is the same thing as splunk enterprise

 

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @trojan_81,

about your assertions:

1. Splunk cloud is doing these roles:  indexer and search head

Splunk roleas are always the same, but you don't see Indexers, only Search Heads; Indexers are used but they are outside of your control.

2. Splunk cloud is the same thing as splunk enterprise

If you're speaking of features, Splunk Cloud and Splunk Enterprise are more or less aligned.

if you're speaking of architecture, they are only a few different:

  • you don't access Indexers, only Search Heads,
  • for Splunk Cloud is a best practice to use at least two Heavy Forwarders as concentrators between your targets and Splunk, for Splunk Enterprise you don't need them.

In both cases, you need a Deployment Server and Universal Forwarders.

If you're speaking of data retention, in Splunk Cloud you have to deeply analyze your requirements because there are limitis in retention, instead in Splunk Enterprise retention depends only on available storage.

At least, if you're speaking of management, in Splunk Cloud you have an Indexer Cluster and a search Head Cluster that you don't need to manage and maintain and you haven't problems of resources and performaces, otherwise, in Splunk Enterprise you have to design, install, configure and maintain them.

Ciao.

Giuseppe

View solution in original post

inventsekar
Ultra Champion

Hi @trojan_81 .. For future questioners, let me post this as a reference:

1. OnSplunk Docs page, tab 4 is the "Deploy", which gives lots of ideas for splunk design and deployment architectures

https://docs.splunk.com/Documentation/Splunk

2. Splunk training provides these 4 free courses - 

https://www.splunk.com/en_us/training/free-courses/overview.html

 

Happy Splunking | Best Regards | Sekar | PS - Karma points appreciated!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @trojan_81,

about your assertions:

1. Splunk cloud is doing these roles:  indexer and search head

Splunk roleas are always the same, but you don't see Indexers, only Search Heads; Indexers are used but they are outside of your control.

2. Splunk cloud is the same thing as splunk enterprise

If you're speaking of features, Splunk Cloud and Splunk Enterprise are more or less aligned.

if you're speaking of architecture, they are only a few different:

  • you don't access Indexers, only Search Heads,
  • for Splunk Cloud is a best practice to use at least two Heavy Forwarders as concentrators between your targets and Splunk, for Splunk Enterprise you don't need them.

In both cases, you need a Deployment Server and Universal Forwarders.

If you're speaking of data retention, in Splunk Cloud you have to deeply analyze your requirements because there are limitis in retention, instead in Splunk Enterprise retention depends only on available storage.

At least, if you're speaking of management, in Splunk Cloud you have an Indexer Cluster and a search Head Cluster that you don't need to manage and maintain and you haven't problems of resources and performaces, otherwise, in Splunk Enterprise you have to design, install, configure and maintain them.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @trojan_81,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...