We are deploying hosting to various organizations in our "company". Each organization in our company may consist of numerous apps (100+ and 5,000+ employees). Our intention is to provide these organizations with an AWS Account, which would be consumed into our AWS deployment infrastructure. Each VPC/AWS Account will hold various apps and types of data. My query is should I be looking to treat each of these accounts as a separate Splunk site (Multisite deployment) and searches are local to that VPC? Or instead, should I route log traffic to a separate "master" VPC deployment as a larger clustered deployment? Qty of apps/users is a sliding scale as our project grows. Today it's 1 app only - next year it could be 100 per organization. I had initially intended to route logs securely to a single Splunk Enterprise cluster made up of say 1 search head & 2-3 indexes and grow out as demand grows. But on reading about multisite, there seems to be quite a lot of benefits. However, suspect costs saved via VPC traffic cost vs oodles of nodes/indexers/search heads per AWS account will be lost. Or would it be better to view Multisite as a longer term strategy deployment of Splunk — as the project grows etc.. — and then migrate deployment at a later date? Thoughts welcome. ... View more

OK basically I think I'm confusing myself. I have a helm deployment on K8 and orig had volumes for etc and var. I want to have separate volumes for hotwarm, cold, frozen and thawed. I created some PVC/volumes for each e.g. mapping to var/cold,var/hot etc but is this correct? I know in the index.conf you set paths e.g. per index, but can this be .... var/hotwarm/index1/? Is it ok to have 3-4 vols for each of the temps and put the indexes on each, or do I need a volume per index? I'm just getting confused. Any help appreciated. I'm also guestimating sizes of volumes - currently, we don't use Splunk much, but it's going to grow rapidly I suspect!! E.g. my helm script includes this: volumeMounts: - name: splunk-etc mountPath: /opt/splunk/etc - name: splunk-var mountPath: /opt/splunk/var - name: splunk-var-hotwarm mountPath: /opt/splunk/var/log/splunk/hotwarm - name: splunk-var-cold mountPath: /opt/splunk/var/log/splunk/cold - name: splunk-var-frozen mountPath: /opt/splunk/var/log/splunk/frozen ... View more

Im new to both k8 and splunk. I'm interested in the best practice of deploying changes of various conf files to either search/indexers or to forwarders. My intention is to embed conf changes into my helm deployments and either spin up or update the pods as applicable via helm. Where forwarders are baked into an AMI for non dockerised apps the updates will scripted into a "golden image/AMI" via jenkins. Is this approach OK - or should we apply conf updates via jenkins by uploading files onto the master and let splunk replicate the conf updates? I hope this makes sense. ... View more