Splunk Enterprise Security

What are best practices to install Splunk & Splunk App for Enterprise Security on Windows or Linux?

splunk2015P
New Member

Hello,

I would like to know what are the steps to install and deploy Splunk & the Splunk App for Enterprise Security to avoid performance problems?

Any help please ?

Thanks

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

Hello,

you should take care about:

  • Design your indexes to optimize the searches (do not mix huge proxy logs with small ids logs for ex.)
  • Policy retention in order to make sure that relevant data will be on fast disks
  • have multiple indexers than one big box
  • dedicate Search Head for ES (if others apps will be used)
  • tune datamodel acceleration based on your needs and data.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...