Splunk itsi and splunk enterprise security on same indexer cluster

[bishtk]

Hello Experts,

Checking if we can plan and implement splunk itsi (on a separate sh cluster) and splunk es(on a separate sh cluster) both pointing to same set of indexer cluster?
Please provide links if there's any available justifying above

[broberg]

Hi.
We run both on a multisite index-cluster with 60 indexers without any issues.
ITSI runs on a search head cluster with 8 search head
ES runs on a ES search head cluster with 4 search heads.

[bishtk]

Hi @broberg
Could you please also let me know the data volume per day in your environment is?

[broberg]

We index about 6TB a day.
All log go trough Heavy forwarder before they reach the indexers, and we have just implemented some indexers on an other cluster on Google Cloud Platform aswell to make it easier to scale the environment.

[bishtk]

Thank you @broberg

So is there anything I need to take care wrt ES and ITSI on same multisite architecture apart from implementing/configuring them on separate searchhead cluster??

[broberg]

Not what i can come up to at the moment i can talk to some colleages that did the ES implementation, but it was a long time ago. Just follow the documentation and im sure it will go smooth.

[bishtk]

Thank you once again