Query on security mechanism of SPLUNK

[Subhasis_85]

I work for a multinational company and my supervisor wants me to investigate on the uses of SPLUNK and how it can be helpful to our project. I have gone through documentation provided in the website and gathered some information about the product but my main area of concern is data security (I work in a payroll domain company and data is very critical for us). So here are my questions.

1. So by using SPLUNK, will we have to share our data with any third party or portal?
2. SPLUNK software, is it a local installation?
3. Will the data at any time during the uses of SPLUNK go out of our network?

EDIT: I couldn't leave it spelt incorrectly... 🙂 -Drainy

[gkanapathy · Accepted solution]

Well, first of all, it's "Splunk", not "Spunk".

1. No
2. Yes
3. No, unless you configure it to do so or otherwise do something to make it happen.

[DaveSavage]

By way of support to the above - we ran up instances, 'islanded' due to security requirements which met very stringent accreditations.
The devil in the detail re Q3 - if you are a Network Engineer then no probs. If you are an end user then perhaps seek advice. Users access Splunk via HTTP or HTTPS to run searches so how much control you have over your user community is probably your exposure, and where the indexer is / any forwarders. Well worth engaging consultancies to plan your deployment model if complex. Eqalis in the UK are excellent. Good luck, have fun - its a great product.

[Subhasis_85]

I am really sorry for misspelling Splunk, and thank a lot for your clear and concise reply. This will help me a lot..