One additional point MC + DS live together. It depends if your admins and persons are same staff or not. As MC is usually targetted only to admins not other persons, you should really think if you want to mix those roles. I know that many cases this is not issue but still something to consider. ... View more

Many thanks ... View more

hi @Wohamed_wakkad , it looks like you have 4 helpful replies from Splunk Trust members already. I will just add the following. Load Balancer Method (in front of syslog) - Challenges around SRC-NAT, output to IP not FQDN makes it harder later - You can resolve this through routing table entries, host files or other options such as F5 irules but there is some complexity to manage Keepalived method - VRRP solution, linux standard offering that is popular and easy to implement - I would also recommend the Rsyslog Assistant for writing a good config that will output to folders etc - I have used this at 3 clients in the past couple of years and it is long term reliable and straight-forward ... View more

Yes, I have used a VRRP-based solution (I think it was keepalived) in the past. It solves some problems, introduces another layer of complexity and possibly another set of issues. I've also seen anycast-based solutions. Unfortunately, syslog is just a simple tool and no amount of fiddling with it or around it can make it 100% reliable. ... View more

Generally there are strict requirements (no ITSI and ES on the same SH/SHC) and guidelines (don't put unnecessary stuff on ES environment). To be on the safe side you shouln't run anything unnecessary on your ES instance(s). It's hard to say "no other apps" because it highly depends on what apps are we talking about (for example - an addon with a reporting action can be perfectly justified on ES) but if you have too many "strange" things installed, you might get into supportability problems and Splunk support might at some point tell you to clean your environment because any issue you might raise with them might be caused by additional apps, not ES itself. ... View more