Main differences between Splunk Enterprise and Splunk Cloud

[JoeSco27]

Currently we have an all On-Prem Splunk enterprise environment. From an administration perspective what is the differences if we move to a Splunk Cloud environment. What will be the differences in managing the deployment of apps? Any and all information is welcome. Thank you.

[sloshburch]

I think some of the URLs have moved over time. So here's their location as of today:

• Splunk Platform Comparison
• Differences between Splunk Cloud and Splunk Enterprise

[mmacvicar_splun]

They've made an effort to document the key differences here http://docs.splunk.com/Documentation/SplunkCloud/6.4.1/User/DifferencesbetweenSplunkCloudandSplunkEn...

[andrewb_splunk]

The Splunk Cloud documentation also provides a more detailed comparison of Splunk Cloud and Splunk Enterprise: http://docs.splunk.com/Documentation/SplunkCloud/6.4.1/User/Overview.

[richgalloway]

I am not a Cloud user, but did investigate moving in that direction. The key difference between Enterprise and Cloud is you have no control over the underlying infrastructure with Cloud. You can install and manage apps using the familiar GUI, but any changes to the platform (permissions changes, program installation, etc.) are done by Splunk support via a ticket.

As with any cloud service, there are also security considerations - that is, can Splunk Cloud still access all of your on-premises data sources.

[yannK]

You will be sending the data to the splunkcloud deployment using a splunk forwarder installed on your on-prem servers. So you not need to open your inbound access, only outbound ports to send data to the cloud servers.,

Exceptions :
- if you have an app that uses a script to collect logs remotely using an API (ldap search, db connect, or AWS S3 monitoring by example), then the inputs collector may be on the cloud instance, and may require some firewall work.