Splunk Enterprise Security

How to install the Splunk App for Enterprise Security on Linux with indexer clustering?

brent_weaver
Builder

Hello!

I am about to embark on an install of the Splunk App for Enterprise Security on a set of shiny new CentOS Linux servers. Here is the config:

4 Clustered Indexer Servers
2 Search Heads
1 Deployment server with License manager running on it

Some of my questions are as follows:

  1. I have chosen to use xfs as the filesystem for indexes. I will be striping the lv across 16 LUN's, which cluster size should I use for optimal perf? Is xfs the correct fs for this in the first place? Should I break out the hot and cold areas into multiple mount points? I expext about 5k iops per sec on each disk.

  2. Given that this env has clustered indexers, what considerations should I make?

  3. I understand that ES relies heavily on sourcetype, what are the implications in ES if I create my own sourcetypes?

ANY advice to spare me future pain is more than welcome. Thanks!

0 Karma

miront
Explorer

Just follow best practices with the common information model and reference the dashboard requirement matrix and you will be in good shape.

http://docs.splunk.com/Documentation/CIM/4.2.0/User/Overview
http://docs.splunk.com/Documentation/ES/3.3.0/Install/Dashboards

0 Karma

tskinnerivsec
Contributor

ES relies a lot more on tags then it does sourcetypes. If you are creating your own sourcetypes, take a look through the common information model documentation and the ES dashboard matrix. You'll need your custom sourcetypes to map into the datamodels that ship with ES and have the proper field extractions. If you can map your data to sourcetypes from the technology add-ons that ship with ES, you will save yourself a ton of work. By the way, an entire book could be written on this set of questions.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...