Splunk Enterprise Security

Has any great person here written a Back up / DR for Splunk ES? Any guidance is much appreciated.

SamHTexas
Builder

I have Indexer clustering, SH clustering in a distributed environment. 

Labels (1)
0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

For the ES portion of things, also consider this:
https://docs.splunk.com/Documentation/ES/6.6.0/Install/InstallEnterpriseSecuritySHC#Back_up_and_rest... 

Let me know if that helps. 

0 Karma

codebuilder
Influencer

This is a complex topic and you should really engage Splunk support for guidance on how to implement these strategies.

With that said, one option for DR is to implement multi-site clustering.

https://docs.splunk.com/Documentation/Splunk/8.2.1/Indexer/Multisitearchitecture

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...