Splunk Enterprise

Sync between Onprem SH and Azure search head

saikiran334
Explorer

Hello , 

1) Currently we do have a search head in OnPrem where indexer clusters have been connected to !

2) Now, we would like to spin up new Splunk SH instance(on Ubuntu)  in AZURE and install  "TrackMe" app on this new Azure SH by syncing with OnPrem SH 

Is this a use case anyone already tried or is it possible to apply ?

Reason: We'd like to have our own SH in Azure exclusively for our own team and utilize it

 

Labels (2)
0 Karma

saikiran334
Explorer

thanks, @guilmxm @isoutamo  for your views on it

I'm thinking to connect Azure SH(stand-alone)  with the Onprem indexer cluster (by taking network configs, firewalls, etc into account) 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
This should work w/o issues.

guilmxm
Influencer


Hi @saikiran334 

I am afraid that even after very carefully reading your question, I am not getting it.

"on this new Azure SH by syncing with OnPrem SH" no idea what you mean here.

You can install TrackMe in any search head, standalone or SHC, that makes sense for you, if the search head can search in the indexers you need, then TrackMe will be able to access to it.

Guilhem

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @guilmxm said you could install a new SH to Azure, but syncing it with onprem SH is another story. There is no automatic way to sync individual SHs. Of course you could keep same apps etc in those, but there is no way to keep users’ changes in sync with those. If this is what you want then you must install SHC which spread over those sites. This require that there haven’t been too much latency (200 ms) between nodes. You also needs four nodes (3xSH + 1 deployer) to build it.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...