The document discusses the different components in a Splunk deployment architecture. It lists the roles of universal forwarders, heavy forwarders, indexers, search heads, deployment servers, and license masters. It also provides diagrams showing how these components can be arranged in a multi-site deployment with forwarders collecting logs from different cities and indexers, search heads and other centralized components.

1. Arash Gholamabolfazl
‫ارائه‬ ‫تصویری‬ ‫و‬ ‫صوتی‬ ‫فایل‬ ‫دریافت‬:
http://www.esoc.ir/RQ_Form.html

2. ●
● Splunk Developers
● Splunk Administrators

3. ●
1. Universal Forwarder
2. Light Forwarder
3. Heavy Forwarder
4. Indexer
5. Search Head
6. Deployment Server
7. License Master

4. ●
Log Collectors

5. City A City B City C City D
UF UF UF UFUF

6. City A City B City C City D
UF UF UF UFUF
HF HF

7. City A City B City C City D
UF UF UF UFUF
HF HF

8. City A City B City C City D
UF UF UF UFUF
HF HF

9. City A City B City C City D
UF UF UF UFUF
HF HF

10. Indexer IndexerIndexer
Search Peers / Indexer Node
City A City B City C City D
UF UF UF UFUF
HF HFHF HF

11. Indexer IndexerIndexer
Search Peers / Indexer Node
City A City B City C City D
UF UF UF UFUF
HF HFHF HF
Search Head

12. Indexer IndexerIndexer
Search Peers / Indexer Node
City A City B City C City D
UF UF UF UFUF
HF HFHF HF
Search Head
License
Master

13. Indexer IndexerIndexer
Search Peers / Indexer Node
City A City B City C City D
UF UF UF UFUF
HF HFHF HF
Search Head
License
Master

14. Indexer IndexerIndexer
Search Peers / Indexer Node
City A City B City C City D
UF UF UF UFUF
HF HFHF HF
Deployment
Server
HF HF
New Configuration