About YeswanthReddy

YeswanthReddy · ‎07-06-2021

Hi All, Good Day!! This is regarding of gluster FS and PostgreSQL DB in Phantom. which we have a cluster with full of components (3 Nodes- 1 Master, 2 nodes &Splunk embedded, gluster FS and PostgreSQL DB). Our query is can we migrate gluster FS and PostgreSQL DB in to a single server as we have cost constraints and can be able to have only single sever for both BD and FS. Will that be possible? is there any issues or challenges will arise, if we do that?. Do you have any sequence of steps to do that. Kindly help us with the details for the above. Regards, Yeswanth M.

YeswanthReddy · ‎07-04-2021

Hi Team, Good Day!! Please note that we chose the cluster Architecture for Splunk Phantom SOAR and the components are (3 Nodes- Node1, Node2 & Master Node, HA/Load Balancer, PostgreSQL DB, GlusterFS and Splunk embedded) here my concern is how to carry the installation of Splunk embedded on Splunk Phantom, since it's a separate component in my environment. is there any specific installer(RPM) for this? Could you help me with any docs or any sequence of steps for the initial installation of SOAR on Cluster. Thanks in Advance. Regards, Yeswanth M,

YeswanthReddy · ‎06-30-2021

@phanTom Thanks alot for the heads up , Yeah we are thinking to go with HTTP Event Collector (HEC) methodology via Remote search app to achieve the Search capability but my concern is 1. Do we need still install the Splunk Embedded service even we use the remote search App ? to connect with external Splunk cloud instance. Since we already have an existing Infra build so long before 2. Which one is the best practice , Using the Remote search app or default Splunk embedded service? Could you please help me to understand the above queries . Thanks alot in advance. Regards, Yeswanth M.

YeswanthReddy · ‎06-29-2021

Hi All, Good Day!! This is an Splunk Phantom Architecture question, which we are in the intial stage of building the Splunk Phantom and considering C1E+ netwrok topology(snip attached) as we have external Splunk instance (both Indexer & Search head) but the Splunk is on Cloud (saas product) 1. My question is would it support for building the Splunk Phantom with out Splunk embedded instace(which would be part of Splunk Architecture)? as we have external Splunk instance which is on cloud. 2. What is the major functionality of Splunk embedded here in the Phantom Architechture? 3. Any barriers/ issues to build with Phantom infrastructure without Splunk embedded? 4. What is the version of Phantom would support to build without Splunk embedded. Looking for response from your end, which will help us alot to have a cosnsistent environment. Regards, Yeswanth M.

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-29-2021

Online Status	Offline
Date Last Visited	‎07-26-2021 08:59 AM

Phantom SOAR - gluster FS and PostgreSQL DB

Phantom installation Guidance

Phantom Architecture Concern

Phantom SOAR - gluster FS and PostgreSQL DB

Phantom installation Guidance

Re: Phantom Architecture Concern

Phantom Architecture Concern