The volume of data from collecting log files from 50 Linux servers and 200 Windows servers

[nandhukiran37]

The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will

require multiple indexers

Following best practices, which types of Splunk component instances are needed?

1. Indexers, search head, universal forwarders, license master
2. Indexers, search head, deployment server, universal forwarders
3. Indexers, search head, deployment server, license master, universal forwarder
4. Indexers, search head, deployment server, license master, universal forwarder, heavy forwarder

[toney_mu]

Hi @nandhukiran37 

You may opt for - Indexers, search head, deployment server, license master, universal forwarder.

But you may also go for Indexers, search head, deployment server, license master, universal forwarder, heavy forwarder, adding an HF is better if you have lot of data and needs further parsing

[gcusello]

Hi @nandhukiran37,

the roles of Splunk Servers, as you can easily think, depend on your requisites:

• Indexers must always be present, the number depends on the volume of data, users and scheduled searches; Indexers must be clustered if you have HA requisites, they must be dedicated servers;
• If you have Clustered Indexers, you need also a Master Node to manage cluster;
• Search Heads must always be present, the number depends on the volume of data, users and scheduled searches; Search Heads must be clustered if you have HA requisites, they must be dedicated servers;
• If you have clustered Search Heads, you need also a Deployer to manage cluster;
• License Master must always be presen, this is a role that can use a server shared with othe roles;
• Universal Forwarders are the Splunk agent  installed on the target systems to monitor, they aren't mandatory but I hint to use them;
• Deployment Server is a role that's mandatory if you have to manage many Universal Forwarders; you need a dedicated server if you have to manage more than 50 clients;
• Heavy Forwarders aren't mandatory, they are a full Splunk installation that usually doesn't index data, they are  used usually in two ways:
  • as a log concentrator, when you have segregated networks that you don't want to open much,
  • as a syslog server;
• in both case Heavy Forwarders should be duplicated (and they need a Load Balancer) if you have HA requisites.

At the end of this description, my hint is to engage a Splunk Architect to design your Splunk architect and define the correct sizing for all the systems.

You can find some documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Deploy/Manageyourdeployment

Ciao.

Giuseppe