Splunk Enterprise Security

Splunk itsi and splunk enterprise security on same indexer cluster

bishtk
Communicator

Hello Experts,

Checking if we can plan and implement splunk itsi (on a separate sh cluster) and splunk es(on a separate sh cluster) both pointing to same set of indexer cluster?
Please provide links if there's any available justifying above

0 Karma

broberg
Communicator

Hi.
We run both on a multisite index-cluster with 60 indexers without any issues.
ITSI runs on a search head cluster with 8 search head
ES runs on a ES search head cluster with 4 search heads.

bishtk
Communicator

Hi @broberg
Could you please also let me know the data volume per day in your environment is?

0 Karma

broberg
Communicator

We index about 6TB a day.
All log go trough Heavy forwarder before they reach the indexers, and we have just implemented some indexers on an other cluster on Google Cloud Platform aswell to make it easier to scale the environment.

0 Karma

bishtk
Communicator

Thank you @broberg

So is there anything I need to take care wrt ES and ITSI on same multisite architecture apart from implementing/configuring them on separate searchhead cluster??

0 Karma

broberg
Communicator

Not what i can come up to at the moment i can talk to some colleages that did the ES implementation, but it was a long time ago. Just follow the documentation and im sure it will go smooth.

0 Karma

bishtk
Communicator

Thank you once again

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...