Splunk Enterprise Security

Does Splunk App for Enterprise Security support multi-site cluster architecture?

rgaleone1
Path Finder

Splunk documentation for the Enterprise Security App lists support for single-site cluster architectures. I am planning a large ES installation across multiple geographical locations and wanted to know if the ES app (latest version) was able to support a multi-site cluster architecture.

Source: Splunk Enterprise Security App Installation and Configuration Manual

ekost
Splunk Employee
Splunk Employee

The Enterprise Security app Deployment planning topic on Clustering has been updated to show support for multisite clustering. Please note that a single-site or multi-site cluster architecture can have one search head or search head pool with a running instance of the Splunk App for Enterprise Security. Any other search heads cannot run the Enterprise Security app.

Thanks!

mahamed_splunk
Splunk Employee
Splunk Employee

ES 3.1.0 has been certified to run on multisite clustering. Filed a request to update the docs.

Get Updates on the Splunk Community!

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...