splunk cloud

[trojan_81]

Hello all,

My organization is using splunk cloud.  I log into splunk cloud to run searches and also access the enterprise security app from there as well.

Given the above statement, are the below statements correct?

1. Splunk cloud is doing these roles:  indexer and search head

2. Splunk cloud is the same thing as splunk enterprise

[inventsekar]

Hi @trojan_81 .. For future questioners, let me post this as a reference:

1. OnSplunk Docs page, tab 4 is the "Deploy", which gives lots of ideas for splunk design and deployment architectures

https://docs.splunk.com/Documentation/Splunk

2. Splunk training provides these 4 free courses - 

• Free Splunk Fundamentals 1
• Splunk Infrastructure Overview
• Splunk User Behavior Analytics
• SignalFx Fundamentals Series (eLearning)

https://www.splunk.com/en_us/training/free-courses/overview.html

Happy Splunking | Best Regards | Sekar | PS - Karma points appreciated!

[gcusello · Accepted solution]

Hi @trojan_81,

about your assertions:

1. Splunk cloud is doing these roles:  indexer and search head

Splunk roleas are always the same, but you don't see Indexers, only Search Heads; Indexers are used but they are outside of your control.

2. Splunk cloud is the same thing as splunk enterprise

If you're speaking of features, Splunk Cloud and Splunk Enterprise are more or less aligned.

if you're speaking of architecture, they are only a few different:

• you don't access Indexers, only Search Heads,
• for Splunk Cloud is a best practice to use at least two Heavy Forwarders as concentrators between your targets and Splunk, for Splunk Enterprise you don't need them.

In both cases, you need a Deployment Server and Universal Forwarders.

If you're speaking of data retention, in Splunk Cloud you have to deeply analyze your requirements because there are limitis in retention, instead in Splunk Enterprise retention depends only on available storage.

At least, if you're speaking of management, in Splunk Cloud you have an Indexer Cluster and a search Head Cluster that you don't need to manage and maintain and you haven't problems of resources and performaces, otherwise, in Splunk Enterprise you have to design, install, configure and maintain them.

Ciao.

Giuseppe

[gcusello]

Hi @trojan_81,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉