O slideshow foi denunciado.
Utilizamos seu perfil e dados de atividades no LinkedIn para personalizar e exibir anúncios mais relevantes. Altere suas preferências de anúncios quando desejar.

Architecting your Splunk deployment

3.151 visualizações

Publicada em

  • Entre para ver os comentários

Architecting your Splunk deployment

  1. 1. !"#$%&()*+*,-.,*/#0123*4256*7%5(&)8592*$"1%*/#0123*:8#0"$;82)*<"==*>"(2?)"2*/@08?*A2&288%*B*C8=8%@0*)D"(2?)"2E?#012365";*
  2. 2. 782=@**•  /&F&2*G%"58??* -  !@#@5&)$* -  H8I8%8258*G"&2)?* -  J@%=K@%8*!"2?&=8%@9"2?*•  7%5(&)8592*@*=&?)%&L1)8=*/#0123*82M&%"2;82)* -  N1&0=&2*N0"53?* -  :%&M&2*C@5)"%?* -  /)@2=@%=*;"=80?*
  3. 3. /#0123*:&?)%&L1)8=*!";#"282)?* /8@%5(*(8@=*P%810@%*@2=*D"L*?8%M8%Q* 42=8O8%* :8#0"$;82)*/8%M8%* C"%K@%=8%* P7*/#0123*&2?)@258*5@2*(@M8*@2$*"%*@00*%"08?Q**
  4. 4. /#0123*:&?)%&L1)8=*!";#"282)?* :8#0"$;82)*S"2&)"%* * •  /(&#?*K&)(*/#0123*B*=&?@L08=* /6R6/* * •  42=8O*)(%"1(#1)*"M8%*9;8** •  T1;L8%*"I*I"%K@%=8%?*5"228592*)"*)(8* &2=8O8%*"M8%*9;8** •  42=8O8%*@2=*I"%K@%=8%*@L2"%;@0&98?** •  :8)@&0?*I"%*&2=&M&=1@0*I"%K@%=8%?*@2=* &2=8O8%?U*?15(*@?*?)@)1?*@2=*I"%K@%=&2* M"01;8*"M8%*9;8** •  /"1%58*)$#8?*L8&2*&2=8O8=*L$*)(8*?$?)8;** •  V&582?8*1?@8** *
  5. 5. /#0123*:&?)%&L1)8=*!";#"282)?* /#0123*"2*/#0123*W** * •  !"2X1%@9"2*C&08*Y&8K8%* •  A%%"%?* •  Z@%2&2?* •  !%@?(*V"*Y&8K8%* •  42=8O&2*G8%I"%;@258* •  /8@%5(*:8)@&0*759M&)$* •  [4*@2=*[?8%*/8@%5(*759M&)$* •  /5(8=108%*759M&)$* •  S8)%&5?*
  6. 6. /&F&2*42=8O*Y"01;8*•  J"K*;15(*&2=8O&2*P%@K*?&F8?Q]** -  :@&0$U*G8@3U*H8)@&28=U*C1)1%8*Y"01;8** -  <")@0*21;L8%*"I*=@)@*?"1%58?* -  <")@0*21;L8%*"I*("?)?** !"#$%&()) *+,-./)0+$+) B"$#-<)$C) 0+$+,.$() "  !0&53W?)%8@;*=@)@* "  S@21I@5)1%&2U*0"&?95?e* "  /("##&2*5@%)*=@)@* "  !:H?*f*4G:H?* "  R20&28*)%@2?@59"2*=@)@* "  G"K8%*5"2?1;#9"2* "  HC4:*=@)@* "  dG/*=@)@* V"X08?* !"2X?* S8??@8?* <%@#?** S8)%&5?* /5%&#)?* !(@28?* <&538)?* *708%)?* A-.<%6#) =-.">?@.->) 9-($"+3-:+4%.)) 1223-,+4%.#) 0+$+8+##) 5$6%(7-./) "  H8&?)%$* "  !"2X1%@9"2?* ;)!3%"<) "  Z8L*0"?* "  !"2X1%@9"2?* "  !"2X1%@9"2?* "  AM82)*0"?* "  ?$?0"* "  V"_>U*>S/U*>S`* "  71=&)bc18%$*0"?* "  ?$?0"* "  J$#8%M&?"%* "  C&08*?$?)8;* "  C&08*?$?)8;* "  d18?)*R/U*7##?* "  6TA<*8M82)?* "  <@L08?* "  /TSG* " ?$?&2)8%2@0?* "  #?U*&"?)@)U*)"#* "  !0"1=* "  !"=8*@2=*?5%&#)?* "  /5(8;@?* " 28a0"K* ^
  7. 7. /&F&2*/8@%5(*Y"01;8*•  J"K*;15(*?8@%5(&2]* -  [?8W5@?8**H8#"%92U*:@?(L"@%=U*@=W("5*)%"1L08?(""92* -  J"K*;@2$*1?8%?]* -  >"L?**/1;;@%&F@9"2U*708%92U*H8#"%92*
  8. 8. /&F&2*H85&#8*•  A?9;@)8*42#1)*Y"01;8* -  Y8%&I$*%@K*0"*?&F8?* -  V8M8%@8*g&2)8%2@0U*:8#0"$;82)*S"2&)"%U***************;8)%&5?*)"*8)*@5)1@0*&2#1)* M"01;8?*•  !"2X%;*8?9;@)8?*K&)(*@5)1@0*=@)@* -  !%8@)8*@*L@?80&28*K&)(*%8@0*"%*?&;10@)8=*=@)@* -  C&2=*!";#%8??&"2*%@)8?*P)$#&5@00$*h-i*"I*"%&&2@0*?&F8Q* -  :8)8%;&28*H8)829"2*288=?*•  :"51;82)*[?8*!@?8?* -  [?8*5@?8*=8)8%;&28?*?8@%5(*288=?*Pj*?8@%5(8?*@2=*1?8%?Q* -  /#@%?8*M?6*:82?8*?8@%5(8?* -  G0@2*I"%*8O#@2?&"2*@?*@="#9"2*%"K?*
  9. 9. C&2@0*/&F&2*T1;L8%?*•  :@)@*!@#@5&)$** -  :@&0$*@2=*G8@3*•  [?8%*!@#@5&)$** -  !"251%%82)*@2=*<")@0*•  /8@%5(*!@#@5&)$** -  !"251%%82)*@2=*<")@0*
  10. 10. H8I8%8258*G"&2)?*•  Z(@)*="8?*@*%8I8%8258*?8%M8%*0""3*0&38]* -  /)@2=@%=*M?6*70)8%2@9M8?*•  !@#@L&0&98?*#8%*=8#0"$;82)bI1259"2* -  42=8O8%?* -  /8@%5(8%?* -  >"L*?8%M8%* -  :8#0"$;82)*?8%M8%*•  d828%@0*<&#?*I"%*/&F&2*@2=*G8%I"%;@258*
  11. 11. Z(@) ?*@*/#0123* H8I8%8258 */8%M8%]*•  /&F&2*L@?8=*"2*5";;"=&)$*Ok^*?8%M8%?*•  :1@0*c1@=W5"%8*!G[?*@)*l*dJF*•  .^*dN*"I*H7S*B*:"51;82)@9"2*%85";;82=?*kdN*•  _O.-3*HGS*0"5@0*/7/*=%&M8?*Pk--m*4RG?Q*B*4*%85";;82=*.,--*4RG/*•  Y@%&@9"2?*5@1?8*5"%%8?#"2=&2*5(@28?*&2*#8%I"%;@258b %8c1&%8;82)?*
  12. 12. H8I8%8258*70)8%2@9M8?*•  7;@F"2*Z8L*/8%M&58?* -  AO)%@*V@%8*H8?8%M8=*42?)@258*m*AN/*M"01;8?*&2*H74:*.-* -  k*A!,*!";#1)8*[2&)?U*.h*dN*H7S* -  !01?)8%*!";#1)8*42?)@258*&?*50"?8?)*)"*%8@0*(@%=K@%8*•  YSK@%8* -  k*Y&%)1@0*!G[?U*.^*dN*H7SU*[?8*H@K*Y"01;8?*•  7F1%8* -  AO)%@*V@%8*42?)@258* -  k*Z&2="K?*7F1%8*!"%8*P.6^*dJFQU*._*dN*H7S* *
  13. 13. H108?*"I*<(1;L*•  .*%8I8%8258*&2=8O8%*#8%*.--*dNb=@$*•  .*%8I8%8258*?8@%5(*(8@=*#8%*k*)"*.,*1?8%?*•  .*%8I8%8258*D"L*?8%M8%*#8%*,-*5"251%%82)*D"L?*•  .*=8#0"$;82)*?8%M8%*#8%*,---*#"00?b;&2*•  <(8?8*@00*(@M8*8O58#9"2?*@2=*c1@0&X5@9"2?**
  14. 14. J"K*S@2$*42=8O8%?]*•  H108*"I*)(1;L*?@$?*.*#8%*.--*dNb=@$*•  V8@M8?*%"";*I"%* -  :@&0$*#8@3?* -  V&()*?8@%5(&2*@2=*%8#"%92*I"%*@L"1)*l*5"251%%82)*1?8%?*•  T88=*;"%8*&2=8O8%?*I"%* -  J8@M$*%8#"%92* -  S"%8*1?8%?* -  /0"K8%*=&?3?U*?0"K8%*!G[?U*I8K8%*!G[?*
  15. 15. J"K*S@2$*/8@%5(*J8@=?]*•  H108*"I*)(1;L*?@$?*.*#8%*k*)"*.,*5"251%%82)*1?8%?*•  V&;&)*&?*5"251%%82)*!"#$%#&•  ..*%@9"*"I*/8@%5(*n18%$*)"*!G[*•  R20$*@==*X%?)*?8@%5(*(8@=*&I*ol*&2=8O8%?*•  :"2 )*@==*?8@%5(*(8@=?p*@==*&2=8O8%?*&2=8O8%?*="*;"?)*K"%3*•  N1)*$"1*288=*;"%8*&I* -  H122&2*@*0")*"I*?5(8=108=*D"L?*"2*)(8*?8@%5(*(8@=* -  V8M8%@8*/8@%5(*J8@=*G""0&2*PTC/*?(@%8Q*
  16. 16. J"K*S@2$*>"L*/8%M8%?]*•  H108*"I*)(1;L*?@$?*.*#8%*,-*5"251%%82)*D"L?*•  >"L*?8%M8%*&?*D1?)*@2")(8%*?8@%5(*(8@=*•  !"251%%825$*@q85)8=*L$*D"L*=1%@9"2*•  <$#&5@00$*@==*@*D"L*?8%M8%*I"%*?1;;@%&F@9"2*@2=*@08%92*•  /8@%5(*J8@=*#""0&2*K&00*=&?)%&L1)8*0"@=*
  17. 17. J"K*S@2$*:8#0"$;82)*/8%M8%?]*•  H108*"I*)(1;L*?@$?*.*#8%*,---*#"00?b;&21)8*•  >1?)*1?8*"28*=8#0"$;82)*?8%M8%U*@2=*@=D1?)*)(8*#"00&2*#8%&"=*•  YS*&?*""=*(8%8*•  R%*1?8*?";8)(&2*")(8%*)(@2*=8#0"$;82)*?8%M8%* -  #1##8)U*/!!SU*5I82&28U*5(8Ie*
  18. 18. G8%I"%;@258*@2=*/&F&2*<&#?*/$?)8;*5(@28* /8@%5(*/#88=* 42=8O&2*?#88=* C@?)8%*:&?3?* mm* m* 7==*42=8O8%* mm* mm*7==*/8@%5(*J8@=* m* m*/1;;@%$*42=8O* mm* mm*
  19. 19. G8%I"%;@258*@2=*/&F&2*<&#?*/$?)8;*5(@28* /8@%5(*/#88=* 42=8O&2*?#88=*R#9;&F8*/8@%5(8?* mmm*R#9;&F8*G@%?&2* m* m* R#9;&F8*42#1)* G@%?&2* mm* C@?)8%*!G[* m* m*
  20. 20. !@#@5&)$*!*7%5(&)85)1%8*•  /&F&2*H85&#8* -  !@#@5&)$* -  H108?*"I*<(1;L*=8)8%;&28?*T1;L8%*"I*/8%M8%?*•  N1&0=&2*N0"53?*I"%*7%5(&)85)1%8*
  21. 21. N1&0=&2*N0"53?*I"%*7%5(&)85)1%8* /8@%5(*(8@=*P%810@%*@2=*D"L*?8%M8%Q* 42=8O8%* :8#0"$;82)*/8%M8%* C"%K@%=8%* P7*/#0123*&2?)@258*5@2*(@M8*@2$*"%*@00*%"08?Q**
  22. 22. 7%5(&)85)1%8*C@5)"%?*•  Z(@)*@%8*;$*?&F&2*%8c1&%8;82)?]*•  Z(8%8*&?*)(8*=@)@]*•  Z(8%8*@%8*)(8*1?8%?]*•  Z(@)*&?*)(8*?851%&)$*#"0&5$]*•  Z(@)*@%8*)(8*%8)829"2*@2=*5";#0&@258*#"0&5&8?]*•  Z(@)*&?*)(8*@M@&0@L&0&)$*%8c1&%8;82)]*
  23. 23. 7%5(&)85)1%8*C@5)"%?*•  Z(@)*@%8*;$*?&F&2*%8c1&%8;82)?]*** -  :@)@*5@#@5&)$* -  /8@%5(*5@#@5&)$* -  [?8%*5@#@5&)$*•  RL)@&28=*I%";*)(8*?&F&2*#%"58??*
  24. 24. 7%5(&)85)1%8*C@5)"%?*•  Z(8%8*&?*)(8*=@)@]* -  V"5@0*"%*H8;")8*)"*)(8*&2=8O&2*;@5(&28* -  4I*%8;")8*B*1?8*I"%K@%=8%?*K(82*#"??&L08* -  42=8O*&2*0"5@0*=@)@*582)8%*PF"28Q*"%*&2=8O*582)%@00$* -  G8%?&?)*T8)K"%3*=@)@*)"*=&?3*@?*@*L8?)*#%@5958*•  Z(8%8*@%8*)(8*1?8%?]* -  /8@%5(*J8@=*?("10=*L8*0"5@0*)"*1?8%?* -  [?8%*08M80*<r*?8s2*
  25. 25. 7%5(&)85)1%8*C@5)"%?*•  Z(@)*&?*)(8*/851%&)$*G"0&5$]* -  7##0$*[?8%*?851%&)$*#"0&5&8?* !  71)(*;8)("=* !  H"08?* !  C&0)8%?* *•  7##0$*#($?&5@0*?851%&)$*#"0&5&8?* B  42=8O8%*0"5@9"2*
  26. 26. 7%5(&)85)1%8*C@5)"%?*•  H8)829"2U*5";#0&@258U*"M8%2@258* -  Z(8%8*&?*)(8*=@)@*@00"K8=*)"*L8]* -  Z(8%8*&?*)(8*=@)@*2")*@00"K8=*)"*"]* -  Z(8%8*;1?)*)(8*=@)@*"]*•  7M@&0@L&0&)$* -  V"5@0*I@&0"M8%U*I@10)W)"08%@258U*501?)8%&2* -  d8"%@#(&5*=&?@?)8%*%85"M8%$bI@10)W)"08%@258*
  27. 27. 7%5(&)85)1%8*C@5)"%?*Wt*<"#"0"$* <"#"0"$*AO@;#08?*!82)%@0&F8=* :8582)%@0&F8=* J$L%&=*
  28. 28. !82)%@0&F8=*<"#"0"$*Search head and job server indexers Intermediate forwarders forwarder forwarders syslog devices
  29. 29. :8582)%@0&F8=*<"#"0"$* Search head and job server
  30. 30. J$L%&=*<"#"0"$*
  31. 31. /5@0&2*@2=*AO#@2?&"2*•  7==*)"*$"1%*&2=8O8%*#""0*I"%*;"%8*#8%I"%;@258*"%*M"01;8* -  S&O8=*G0@a"%;*@2=*J@%=K@%8*&?*"3@$*•  [?8*/8@%5(*J8@=*G""0&2*I"%*;"%8*[4*5@#@5&)$* -  H8c1&%8?*TC/*•  !%8@)8*28K*&2=8O8?*I"%*28K*=@)@*)$#8?* -  C"00"K?*L8?)*#%@5958?*
  32. 32. C&2@0*<("1()?*•  /&F&2*&?*;"%8*)(@2*=@)@*M"01;8u&) ?*@0?"*?8@%5(bD"L*0"@=*•  !82)%@0&F8=*@%5(&)85)1%8*&?*)(8*L@?80&28*•  Y@%&@9"2?*"2*@%5(&)85)1%8*@%8*=%&M82*L$* -  /&F&2* -  :@)@*0"5@9"2* -  [?8%*0"5@9"2* -  H8)829"2b7558??bd"M8%2@258* -  7M@&0@L&0&)$*%8c1&%8;82)?*
  33. 33. C&2@0*!";;82)?*•  (v#bbKKK6?#012365";bL@?8b:"51;82)@9"2*•  (v#bb?#0123WL@?86?#012365";b@2?K8%?*
  34. 34. <(@23*$"1* l_*
  35. 35. T8O)*[#**4;#08;82)@9"2*N8?)*G%@5958?*/8@2*Z&038%?"2* lh*

×