Splunk IT Service Intelligence

What is the difference between Splunk Insights for Infrastructure (SII) and Splunk APP for Infrastructure (SAI) ??

AbdelrahmanAbde
Explorer

Hi everyone ,

I have a couple of questions about Splunk Insights for Infrastructure :
I found that Splunk Insights for Infrastructure ( SII ) can be installed separately without the need to install Splunk Enterprise platform

  1. What is the added value that I get when using (SAI) as an app on top of Splunk Enterprise vs using (SII) without having Splunk Enterprise ?
  2. Does this app fits more into physical or virtual environments or it does not matter ? by that I mean will it show me how much RAM and CPU are utilized from the resources I assigned to a certain VM OR will it compare it against the total host's CPU and RAM
  3. When it comes to Disk Performance monitoring ( does this apply also to volumes attached to VMs from shared Storage arrays ) ?
  4. Is it better to use Splunk APP for VMware if I have a virtual environment ?
0 Karma
1 Solution

pwu_splunk
Splunk Employee
Splunk Employee
  1. SII was a product that acted as a simplified version of SAI + Splunk Enterprise. It lacked features like access to Search & Reporting and more granular control of Splunk for users who didn't want to jump right into the complexity of Splunk Enterprise. Most importantly, it's a deprecated product. Going forward, users should use SAI to receive the latest features and updates.
  2. SAI works for both physical and virtual environments. How your resources are displayed depends on how you send data from entities to SAI. For example, based on your configuration, you can discover an AWS server as a standalone Linux server, as part of a larger AWS infrastructure, or as both. As of version 1.4.0, SAI has no support for integrating with VMware directly. However, this may change in the next major release. 😉 Stay tuned.
  3. See above.
  4. Splunk App for VMware and Splunk App for Infrastructure have different features. They're more complimentary rather than one being strictly better than the other.

View solution in original post

pwu_splunk
Splunk Employee
Splunk Employee
  1. SII was a product that acted as a simplified version of SAI + Splunk Enterprise. It lacked features like access to Search & Reporting and more granular control of Splunk for users who didn't want to jump right into the complexity of Splunk Enterprise. Most importantly, it's a deprecated product. Going forward, users should use SAI to receive the latest features and updates.
  2. SAI works for both physical and virtual environments. How your resources are displayed depends on how you send data from entities to SAI. For example, based on your configuration, you can discover an AWS server as a standalone Linux server, as part of a larger AWS infrastructure, or as both. As of version 1.4.0, SAI has no support for integrating with VMware directly. However, this may change in the next major release. 😉 Stay tuned.
  3. See above.
  4. Splunk App for VMware and Splunk App for Infrastructure have different features. They're more complimentary rather than one being strictly better than the other.

AbdelrahmanAbde
Explorer

Thanks
This answers all of my questions .

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...