Splunk Enterprise Security

Splunk itsi and splunk enterprise security on same indexer cluster

bishtk
Communicator

Hello Experts,

Checking if we can plan and implement splunk itsi (on a separate sh cluster) and splunk es(on a separate sh cluster) both pointing to same set of indexer cluster?
Please provide links if there's any available justifying above

0 Karma

broberg
Communicator

Hi.
We run both on a multisite index-cluster with 60 indexers without any issues.
ITSI runs on a search head cluster with 8 search head
ES runs on a ES search head cluster with 4 search heads.

bishtk
Communicator

Hi @broberg
Could you please also let me know the data volume per day in your environment is?

0 Karma

broberg
Communicator

We index about 6TB a day.
All log go trough Heavy forwarder before they reach the indexers, and we have just implemented some indexers on an other cluster on Google Cloud Platform aswell to make it easier to scale the environment.

0 Karma

bishtk
Communicator

Thank you @broberg

So is there anything I need to take care wrt ES and ITSI on same multisite architecture apart from implementing/configuring them on separate searchhead cluster??

0 Karma

broberg
Communicator

Not what i can come up to at the moment i can talk to some colleages that did the ES implementation, but it was a long time ago. Just follow the documentation and im sure it will go smooth.

0 Karma

bishtk
Communicator

Thank you once again

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...