Architecting Splunk

If you have just started learning Splunk, it is unlikely that you would be expected to architect and implement a complex Splunk solution, especially for a larger enterprise. Typically, such projects are advisedly executed with the assistance of experienced architects from Splunk professional services, a Splunk partner consultancy, or your own in-house architects. However, you may be championing an introductory Splunk sandbox or solution at your company, or joining an existing team and need to come up to speed quickly—in which case, this overview should be helpful. 

The topics that will be covered in this chapter include the following:

• Collecting the data needed for choosing an appropriate Splunk configuration
• Understanding the different types of Splunk environments
• Understanding replication and search factors
• Introduction to indexing buckets
• Considerations for search head clusters
• How to select and size the appropriate hardware options for each Splunk component
• Disk-sizing calculations

Let's start with determining the type of Splunk deployment you will build and work with.