Splunk Deployment only for Log Management Purpose

[dheerajsh]

Hi Team,

We have a requirement where we need to deploy Splunk Solution only for Log management purpose (less 50 GB per day). We are planning to have two heavy log forwarder (one in primary and one in DR) which will take the feed from different log sources (Devices (Syslog) and Servers (UF)). The HLF will send the data to indexers for storage (one in each DC) through Network Load balancer to maintain the HA. Also, will send the data to another SIEM solution for correlation and monitoring purpose.

Is there any way that we can installed the Splunk in non-clustered mode with minimum overhead and making sure that we have all the logs as per the Log management requirement.

[woodcock]

You have described what you need to do. You have 2 servers that ideally should be setup as Splunk UF, not HF. You have a load balancer between them with sticky sessions configured. They both have the same outputs.conf file to send to multiple indexer tiers like this:

[tcpout]
defaultGroup = primary_indexers,secondary_indexers
autoLB=true

[tcpout:primary_indexers]
server = your.primary.indexer1.here:9997,...,your.primary.indexerZ.here:9997

[tcpout:secondary_indexers]
server = your.secondary.indexer1.here:9997,...,your.secondary.indexerZ.here:9997

[dheerajsh]

Thanks for your reply. But Can i send the logs to other siem solution from UF along with indexers?

Also, can i setup search head (just to see what logs are coming not for actual searching) on same indexer node?

Is there any chance that i will loose my logs if i will setup indexers in non clustered mode over two DC.