Deployment Architecture

Search Head on Splunk Cloud

cpraz_ord
Explorer

Hi...I believe Splunk Cloud has 3 indexers, what about Search Heads? If there multiple Search Heads, does the ES app get propagated across SH clusters & Index clusters?

Tags (1)

pgreer_splunk
Splunk Employee
Splunk Employee

A base build is 1-3 (being one search head and 3x indexers). Of course, each build is sized to a customer's initial target ingest rate, data retention, etc.

If a customer is large enough (enough concurrent users) a search head might initially be deployed. Otherwise they are single search heads.

You are correct, if there is a premium app purchased (such as ES or ITSI) that warrants it's own search head, then a second (or more) search head will be deployed. Typically a base search head is at a canonical name https://.splunkcloud.com where the additional ES search head would reside at https://es-.splunkcloud.com.

Again, that being said, if the size of the customer, concurrent users, search load, etc. - then a search head cluster might be deployed (for the ad-hoc searching purposes or independently for ES).

As for propagation across search heads and indexers, it depends on the app. If the app requires indexing time props/transforms then there will be configuration pieces on the indexers. If the app only has search time props/transforms then it may only reside on the search head (or search heads if in a search head cluster).

Get Updates on the Splunk Community!

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...