More Related Content
Similar to Architecting your Splunk deployment
Similar to Architecting your Splunk deployment (20)
Architecting your Splunk deployment
- 2. 7'82=@**
• /&F&2'*G%"58??*
- !@#@5&)$*
- H8I8%8258*G"&2)?*
- J@%=K@%8*!"2?&=8%@9"2?*
• 7%5(&)8592'*@*=&?)%&L1)8=*/#0123*82M&%"2;82)*
- N1&0=&2'*N0"53?*
- :%&M&2'*C@5)"%?*
- /)@2=@%=*;"=80?*
- 3. /#0123*:&?)%&L1)8=*!";#"282)?*
/8@%5(*(8@=*P%8'10@%*@2=*D"L*?8%M8%Q*
42=8O8%*
:8#0"$;82)*/8%M8%*
C"%K@%=8%*
P7*/#0123*&2?)@258*5@2*(@M8*@2$*"%*@00*%"08?Q**
- 4. /#0123*:&?)%&L1)8=*!";#"282)?*
:8#0"$;82)*S"2&)"%*
*
• /(&#?*K&)(*/#0123*B*=&?@L08=*
/6R6/* *
• 42=8O*)(%"1'(#1)*"M8%*9;8**
• T1;L8%*"I*I"%K@%=8%?*5"228592'*)"*)(8*
&2=8O8%*"M8%*9;8**
• 42=8O8%*@2=*I"%K@%=8%*@L2"%;@0&98?**
• :8)@&0?*I"%*&2=&M&=1@0*I"%K@%=8%?*@2=*
&2=8O8%?U*?15(*@?*?)@)1?*@2=*I"%K@%=&2'*
M"01;8*"M8%*9;8**
• /"1%58*)$#8?*L8&2'*&2=8O8=*L$*)(8*?$?)8;**
• V&582?8*1?@'8**
*
- 5. /#0123*:&?)%&L1)8=*!";#"282)?*
/#0123*"2*/#0123*W**
*
• !"2X'1%@9"2*C&08*Y&8K8%*
• A%%"%?*
• Z@%2&2'?*
• !%@?(*V"'*Y&8K8%*
• 42=8O&2'*G8%I"%;@258*
• /8@%5(*:8)@&0*759M&)$*
• [4*@2=*[?8%*/8@%5(*759M&)$*
• /5(8=108%*759M&)$*
• S8)%&5?*
- 6. /&F&2'*42=8O*Y"01;8*
• J"K*;15(*&2=8O&2'*P%@K*?&F8?Q]**
- :@&0$U*G8@3U*H8)@&28=U*C1)1%8*Y"01;8**
- <")@0*21;L8%*"I*=@)@*?"1%58?*
- <")@0*21;L8%*"I*("?)?*
* !"#$%&'())
*+,-./)0+$+)
B"$#-<')$C')
0+$+,'.$'()
" !0&53W?)%8@;*=@)@* " S@21I@5)1%&2'U*0"'&?95?e*
" /("##&2'*5@%)*=@)@* " !:H?*f*4G:H?*
" R20&28*)%@2?@59"2*=@)@* " G"K8%*5"2?1;#9"2*
" HC4:*=@)@*
" dG/*=@)@*
V"'X08?* !"2X'?* S8??@'8?* <%@#?** S8)%&5?* /5%&#)?* !(@2'8?* <&538)?*
*708%)?*
A-.<%6#) =-.">?@.->) 9-($"+3-:+4%.)) 1223-,+4%.#) 0+$+8+#'#) 5'$6%(7-./)
" H8'&?)%$* " !"2X'1%@9"2?* ;)!3%"<) " Z8L*0"'?* " !"2X'1%@9"2?* " !"2X'1%@9"2?*
" AM82)*0"'?* " ?$?0"'* " V"'_>U*>S/U*>S`* " 71=&)bc18%$*0"'?* " ?$?0"'*
" J$#8%M&?"%*
" C&08*?$?)8;* " C&08*?$?)8;* " d18?)*R/U*7##?* " 6TA<*8M82)?* " <@L08?* " /TSG*
" ?$?&2)8%2@0?* " #?U*&"?)@)U*)"#* " !0"1=* " !"=8*@2=*?5%&#)?* " /5(8;@?* " 28a0"K*
^
- 7. /&F&2'*/8@%5(*Y"01;8*
• J"K*;15(*?8@%5(&2']*
- [?8W5@?8**H8#"%92'U*:@?(L"@%=U*@=W("5*)%"1L08?(""92'*
- J"K*;@2$*1?8%?]*
- >"L?**/1;;@%&F@9"2U*708%92'U*H8#"%92'*
- 8. /&F&2'*H85*
• A?9;@)8*42#1)*Y"01;8*
- Y8%&I$*%@K*0"'*?&F8?*
- V8M8%@'8*g&2)8%2@0U*:8#0"$;82)*S"2&)"%U***************;8)%&5?*)"*'8)*@5)1@0*&2#1)*
M"01;8?*
• !"2X%;*8?9;@)8?*K&)(*@5)1@0*=@)@*
- !%8@)8*@*L@?80&28*K&)(*%8@0*"%*?&;10@)8=*=@)@*
- C&2=*!";#%8??&"2*%@)8?*P)$#&5@00$*h-i*"I*"%&'&2@0*?&F8Q*
- :8)8%;&28*H8)829"2*288=?*
• :"51;82)*[?8*!@?8?*
- [?8*5@?8*=8)8%;&28?*?8@%5(*288=?*Pj*?8@%5(8?*@2=*1?8%?Q*
- /#@%?8*M?6*:82?8*?8@%5(8?*
- G0@2*I"%*8O#@2?&"2*@?*@="#9"2*'%"K?*
- 9. C&2@0*/&F&2'*T1;L8%?*
• :@)@*!@#@5&)$**
- :@&0$*@2=*G8@3*
• [?8%*!@#@5&)$**
- !"251%%82)*@2=*<")@0*
• /8@%5(*!@#@5&)$**
- !"251%%82)*@2=*<")@0*
- 10. H8I8%8258*G"&2)?*
• Z(@)*="8?*@*%8I8%8258*?8%M8%*0""3*0&38]*
- /)@2=@%=*M?6*70)8%2@9M8?*
• !@#@L&0&98?*#8%*=8#0"$;82)bI1259"2*
- 42=8O8%?*
- /8@%5(8%?*
- >"L*?8%M8%*
- :8#0"$;82)*?8%M8%*
• d828%@0*<&#?*I"%*/&F&2'*@2=*G8%I"%;@258*
- 11. Z(@) ?*@*/#0123* H8I8%8258 */8%M8%]*
• /&F&2'*L@?8=*"2*5";;"=&)$*Ok^*?8%M8%?*
• :1@0*c1@=W5"%8*!G[?*@)*l*dJF*
• .^*dN*"I*H7S*B*:"51;82)@9"2*%85";;82=?*kdN*
• _O.-3*HGS*0"5@0*/7/*=%&M8?*Pk--m*4RG?Q*B*4*%85";;82=*.,--*4RG/*
• Y@%&@9"2?*5@1?8*5"%%8?#"2=&2'*5(@2'8?*&2*#8%I"%;@258b
%8c1&%8;82)?*
- 12. H8I8%8258*70)8%2@9M8?*
• 7;@F"2*Z8L*/8%M&58?*
- AO)%@*V@%'8*H8?8%M8=*42?)@258*m*AN/*M"01;8?*&2*H74:*.-*
- k*A!,*!";#1)8*[2&)?U*.h*dN*H7S*
- !01?)8%*!";#1)8*42?)@258*&?*50"?8?)*)"*%8@0*(@%=K@%8*
• YSK@%8*
- k*Y&%)1@0*!G[?U*.^*dN*H7SU*[?8*H@K*Y"01;8?*
• 7F1%8*
- AO)%@*V@%'8*42?)@258*
- k*Z&2="K?*7F1%8*!"%8*P.6^*dJFQU*._*dN*H7S*
*
- 13. H108?*"I*<(1;L*
• .*%8I8%8258*&2=8O8%*#8%*.--*dNb=@$*
• .*%8I8%8258*?8@%5(*(8@=*#8%*k*)"*.,*1?8%?*
• .*%8I8%8258*D"L*?8%M8%*#8%*,-*5"251%%82)*D"L?*
• .*=8#0"$;82)*?8%M8%*#8%*,---*#"00?b;&2*
• <(8?8*@00*(@M8*8O58#9"2?*@2=*c1@0&X5@9"2?*
*
- 14. J"K*S@2$*42=8O8%?]*
• H108*"I*)(1;L*?@$?*.*#8%*.--*dNb=@$*
• V8@M8?*%"";*I"%*
- :@&0$*#8@3?*
- V&'()*?8@%5(&2'*@2=*%8#"%92'*I"%*@L"1)*l*5"251%%82)*1?8%?*
• T88=*;"%8*&2=8O8%?*I"%*
- J8@M$*%8#"%92'*
- S"%8*1?8%?*
- /0"K8%*=&?3?U*?0"K8%*!G[?U*I8K8%*!G[?*
- 15. J"K*S@2$*/8@%5(*J8@=?]*
• H108*"I*)(1;L*?@$?*.*#8%*k*)"*.,*5"251%%82)*1?8%?*
• V&;&)*&?*5"251%%82)*!"#$%#&'
• ..*%@9"*"I*/8@%5(*n18%$*)"*!G[*
• R20$*@==*X%?)*?8@%5(*(8@=*&I*ol*&2=8O8%?*
• :"2 )*@==*?8@%5(*(8@=?p*@==*&2=8O8%?*&2=8O8%?*="*;"?)*K"%3*
• N1)*$"1*288=*;"%8*&I*
- H122&2'*@*0")*"I*?5(8=108=*D"L?*"2*)(8*?8@%5(*(8@=*
- V8M8%@'8*/8@%5(*J8@=*G""0&2'*PTC/*?(@%8Q*
- 16. J"K*S@2$*>"L*/8%M8%?]*
• H108*"I*)(1;L*?@$?*.*#8%*,-*5"251%%82)*D"L?*
• >"L*?8%M8%*&?*D1?)*@2")(8%*?8@%5(*(8@=*
• !"251%%825$*@q85)8=*L$*D"L*=1%@9"2*
• <$#&5@00$*@==*@*D"L*?8%M8%*I"%*?1;;@%&F@9"2*@2=*@08%92'*
• /8@%5(*J8@=*#""0&2'*K&00*=&?)%&L1)8*0"@=*
- 17. J"K*S@2$*:8#0"$;82)*/8%M8%?]*
• H108*"I*)(1;L*?@$?*.*#8%*,---*#"00?b;&21)8*
• >1?)*1?8*"28*=8#0"$;82)*?8%M8%U*@2=*@=D1?)*)(8*#"00&2'*#8%&"=*
• YS*&?*'""=*(8%8*
• R%*1?8*?";8)(&2'*")(8%*)(@2*=8#0"$;82)*?8%M8%*
- #1##8)U*/!!SU*5I82'&28U*5(8Ie*
- 20. !@#@5&)$*!*7%5(&)85)1%8*
• /&F&2'*H85*
- !@#@5&)$*
- H108?*"I*<(1;L*=8)8%;&28?*T1;L8%*"I*/8%M8%?*
• N1&0=&2'*N0"53?*I"%*7%5(&)85)1%8*
- 22. 7%5(&)85)1%8*C@5)"%?*
• Z(@)*@%8*;$*?&F&2'*%8c1&%8;82)?]*
• Z(8%8*&?*)(8*=@)@]*
• Z(8%8*@%8*)(8*1?8%?]*
• Z(@)*&?*)(8*?851%&)$*#"0&5$]*
• Z(@)*@%8*)(8*%8)829"2*@2=*5";#0&@258*#"0&5&8?]*
• Z(@)*&?*)(8*@M@&0@L&0&)$*%8c1&%8;82)]*
- 23. 7%5(&)85)1%8*C@5)"%?*
• Z(@)*@%8*;$*?&F&2'*%8c1&%8;82)?]***
- :@)@*5@#@5&)$*
- /8@%5(*5@#@5&)$*
- [?8%*5@#@5&)$*
• RL)@&28=*I%";*)(8*?&F&2'*#%"58??*
- 24. 7%5(&)85)1%8*C@5)"%?*
• Z(8%8*&?*)(8*=@)@]*
- V"5@0*"%*H8;")8*)"*)(8*&2=8O&2'*;@5(&28*
- 4I*%8;")8*B*1?8*I"%K@%=8%?*K(82*#"??&L08*
- 42=8O*&2*0"5@0*=@)@*582)8%*PF"28Q*"%*&2=8O*582)%@00$*
- G8%?&?)*T8)K"%3*=@)@*)"*=&?3*@?*@*L8?)*#%@5958*
• Z(8%8*@%8*)(8*1?8%?]*
- /8@%5(*J8@=*?("10=*L8*0"5@0*)"*1?8%?*
- [?8%*08M80*<r*?8s2'*
- 25. 7%5(&)85)1%8*C@5)"%?*
• Z(@)*&?*)(8*/851%&)$*G"0&5$]*
- 7##0$*[?8%*?851%&)$*#"0&5&8?*
! 71)(*;8)("=*
! H"08?*
! C&0)8%?*
*
• 7##0$*#($?&5@0*?851%&)$*#"0&5&8?*
B 42=8O8%*0"5@9"2*
- 26. 7%5(&)85)1%8*C@5)"%?*
• H8)829"2U*5";#0&@258U*'"M8%2@258*
- Z(8%8*&?*)(8*=@)@*@00"K8=*)"*L8]*
- Z(8%8*&?*)(8*=@)@*2")*@00"K8=*)"*'"]*
- Z(8%8*;1?)*)(8*=@)@*'"]*
• 7M@&0@L&0&)$*
- V"5@0*I@&0"M8%U*I@10)W)"08%@258U*501?)8%&2'*
- d8"'%@#(&5*=&?@?)8%*%85"M8%$bI@10)W)"08%@258*
- 31. /5@0&2'*@2=*AO#@2?&"2*
• 7==*)"*$"1%*&2=8O8%*#""0*I"%*;"%8*#8%I"%;@258*"%*M"01;8*
- S&O8=*G0@a"%;*@2=*J@%=K@%8*&?*"3@$*
• [?8*/8@%5(*J8@=*G""0&2'*I"%*;"%8*[4*5@#@5&)$*
- H8c1&%8?*TC/*
• !%8@)8*28K*&2=8O8?*I"%*28K*=@)@*)$#8?*
- C"00"K?*L8?)*#%@5958?*
- 32. C&2@0*<("1'()?*
• /&F&2'*&?*;"%8*)(@2*=@)@*M"01;8u&) ?*@0?"*?8@%5(bD"L*0"@=*
• !82)%@0&F8=*@%5(&)85)1%8*&?*)(8*L@?80&28*
• Y@%&@9"2?*"2*@%5(&)85)1%8*@%8*=%&M82*L$*
- /&F&2'*
- :@)@*0"5@9"2*
- [?8%*0"5@9"2*
- H8)829"2b7558??bd"M8%2@258*
- 7M@&0@L&0&)$*%8c1&%8;82)?*
- 33. C&2@0*!";;82)?*
• (v#bbKKK6?#012365";bL@?8b:"51;82)@9"2*
• (v#bb?#0123WL@?86?#012365";b@2?K8%?*