Splunk Enterprise Security

Enterprise Security 6.x Multisite Search head Cluster

danan5
Path Finder

Hi,

Does anyone happen to know if Multisite search head clustering is suppported in ES 6.x? The validated architectures document says not, but it was written in 2018. Reading the release notes of 6.0, 6.0.1 and 6.1 it sounds like there have been ajustments to the way it handles SHC knowledge objects but I don't know if this changes the advice from the validated design docs.

"a single dedicated search head cluster contained within a siteis required to deploy the app . ES requires a consistent set of runtime artifacts to be available and this cannot be guaranteed in a stretched SHC when a site outage occurs. To be able to recover an ES SH environment from a site failure, 3rd party technology can be used to perform a failover ofthe search head instances, or a "warm standby" ES SH can be provisioned and kept in synch with the primary ES environment.

Regards,
David

0 Karma

nickhills
Ultra Champion

ES can be run on a single site SHC but it is notoriously difficult to a.) get working properly b.) keep working. (Let alone MultiSite)

If you are determined to run ES on SHC you would be highly advised to engage Splunk Professional Services.
They will probably tell you the same thing, but will happily take your money 🙂

There are compelling reasons why you might want to run ES on SHC, and some companies have had great success with it, but this is one to seek some expert on site help with.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...