Designing a Resilient Cloud Native Splunk Architecture on AWS. Talk by Austin Rose, at San Francisco Splunk User group, June 1, 2022

1. © 2019 SPLUNK INC.
Designing a Resilient Cloud Native
Splunk Architecture on AWS
Austin Rose, Director, AWS Cloud Professional Services, InterVision Systems
arose@intervision.com
Join at
slido.com
#8675309

2. Join at slido.com
#8675309
ⓘ Start presenting to display the joining instructions on this slide.

3. © 2019 SPLUNK INC.
Overview
• Disclaimer
• Introduction
• Audience Survey
• Introduction to Splunk on AWS
• “Well-Architected”
• Operational Excellence
• Reliability Pillar
• Cost Optimization Pillar

4. © 2019 SPLUNK INC.
Disclaimer
The views and opinions expressed in this
presentation are those of the authors and do
not necessarily reflect the official policy or
position of any other agency, organization,
employer or company. Assumptions made in
the analysis are not reflective of the position of
any entity other than the author(s) – and,
since we are critically-thinking human
beings, these views are always subject to
change, revision, and rethinking at any
time. Please do not hold us to them in
perpetuity.

5. © 2019 SPLUNK INC.
Introduction
• Splunk Fan since late 2000’s
• 20+ years of IT experience
• 10+ years of Cyber Security Experience
• 5+ years of AWS Cloud Experience
Austin Rose
Director, AWS Cloud Professional Services
InterVision Systems
arose@intervision.com
in/austinerose
Email Me

6. Are you currently running
workloads in AWS?
ⓘ Start presenting to display the poll results on this slide.

7. Are you currently using
Splunk in AWS?
ⓘ Start presenting to display the poll results on this slide.

8. Pillars of AWS Well-Architected
Security
Cost
Optimization
Operational
Excellence
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential
Performance
Efficiency
Reliability

9. © 2019 SPLUNK INC.
Operational Excellence Pillar
includes the ability to support development and run workloads effectively, gain insight
into their operations, and to continuously improve supporting processes and
procedures to deliver business value.

10. © 2019 SPLUNK INC.
Operational Excellence Pillar
● Perform operations as code
● Make frequent, small, reversible changes
● Refine operations procedures frequently
● Anticipate failure
● Learn from all operational failures
How can you be most excellent?

11. © 2019 SPLUNK INC.
Operational Excellence Pillar
● Deployment Servers Rock!
Splunk as Code

12. © 2019 SPLUNK INC.
Operational Excellence Pillar
● Use IaC to create repeatable instances
Infrastructure as Code

13. © 2019 SPLUNK INC.
Operational Excellence Pillar
Infrastructure as Code

14. © 2019 SPLUNK INC.

15. © 2019 SPLUNK INC.
Reliability Pillar
encompasses the ability of a workload to perform its intended function correctly and consistently
when it’s expected to. This includes the ability to operate and test the workload through its total
lifecycle.

16. © 2019 SPLUNK INC.
Reliability Pillar
● Don’t Create Snowflakes
● Treat your indexers as cattle
● Leverage your repeatable IaC
● Go Multi-Site (even if you aren’t…yet.)
● Leverage other technology to bolster
your environment
● S3/SmartStore
Is your Splunk…. Reliable?

17. © 2019 SPLUNK INC.
Reliability Pillar
Simplified*
Is your Splunk…. Reliable?

18. © 2019 SPLUNK INC.
Reliability Pillar
● AWS S3 Stats
● Unlimited Storage (if you are into #datahoarding)
● 99.999999999% Durability across multiple Availability Zones
● 99.99% Availability
● SmartStore Stats
● Cost savings ~ 75%
● Storage Savings dependent on SF/RF – Only a single copy is stored on S3
● 2019 .conf FN1435
SmartStore

19. © 2019 SPLUNK INC.
Cost Optimization Pillar
is a continual process of refinement and improvement over the span of a workload’s lifecycle.

20. © 2019 SPLUNK INC.
Cost Optimization Pillar
● SmartStore
● Cost Savings ~75% (YMMV)
● SPOT Instances
● Cost Savings ~70% over hourly (i3en.6xlarge >20% Interruption)
● Data Hygiene
● Log Onboarding Process
● Potential licensing savings as well
Saving Money

21. © 2019 SPLUNK INC.
Cost-Optimization Pillar
Simplified*
Using Spot Instances in AutoScale Groups to reduce costs

22. © 2019 SPLUNK INC.
Thank You!
Email Me