Designing Splunk architecture.
Learning about Splunk design before implementation of our enterprise level.
High Availability.
Multi-Site clustering is very much necessary since you will have a clear idea of how big an environment
we are implementing as part of our tutorial.
Trust me, it will be one of like you can say it like you have implemented this implementation because
you will be as part of each and every step, right from the beginning of designing the architecture
till the time we complete it and publish it on the Amazon cloud before jumping onto designing completely
the architecture.
We need to understand that architecture design without a proper representation will not affect you.
Impact to make Splunk architecture design impactful.
We will have to do a couple of preparation work, like having visual install and making sure that we
are visual tools installed and what each icon means to understand Splunk visual utensils.
Or you can say that icons would have to go to first let us download our view stencils go to the link
first link.
It is nothing but a wiki page.
The second link is kind of a descriptive and which is used for.
Explaining that each component in those stencils is a PDF document here.
In the first link we can see it's blank with utensils.
It is in Splunk wiki where it has been published and you can download, you can see there are a lot
of components listed.
Probably you might not pick it up now, but once we have done with our final course of publishing our
Enterprise Architecture of Splunk on AWP, you'll be able to understand this most of these components.
Let's click on this video.
STEM cells.
We'll download the video of stem cells downloading and we'll go to page number six.
Yeah.
Icon collection.
You'll be able to see all the icons within those.
Vizio senses what each icon represents.
They are covered almost everything that a Splunk architect would need to create a architect diagram.
They are covered almost every corner of Splunk implementation considering the batch file input indexer,
indexer, clustering and deployment server, cluster master license manager, all the components including
the AVI for order based on the OS level.
As you can see here, every before the for Windows, for Mac, for Linux, these guys have done some
extensive work in publishing this, but this has added a real quality of creating the architecture.
Let me open up my visio.
I'll only create a.
Blank drawing and we are downloaded stencils to add them.
Click on more shapes.
Open stencils.
Splunk documentation or you need to unzip those files.
Since I have already unzipped this is the location so I can click and click on open.
It will automatically add all your Splunk documentation icons.
As you can see here, let me expand it.
See here, you'll be able to see all different types of components using the architecture.
Let me show you how easy it is to create an Splunk architecture using Visio.
I am a user.
And my Splunk architecture.
I'll build on simple architecture considering some small, let's say, ten GB license size.
I'll have a couple of searchers, not tangibly, let us say it is a medium size.
I have a couple of firewalls, sending logs.
Let me have one more firewall.
That is my indexers.
I've had my thoughts.
Yeah, I learned a couple of indexers.
This is one index.
This is group of indexes.
So it is.
We can consider them as multiple indexes.
So what else I need?
Probably every forwarder.
Every forward is allowed.
One forwarder, which is our universal forwarder client.
I'll have one Linux for order, one for Mac forwarder.
These are nothing but the agents that are sitting on these servers like this is generic.
This is for Linux.
This is for Mac.
And.
We will add our windows for order also.
It's a group of orders.
So this is usually the data sources you can represent as one block.
Let me put a container or.
I'll put everything under one container and call this as my four orders.
That's a job done.
So all this will send.
Let me pull out a couple of aromatics.
Whichever you feel comfortable, you can use them, not the two sides.
I'll use the one side because far order is sending logs to my indexer.
Creator of fun.
I have already created a couple of architecture.
We'll go through them one by one.
I'll create one for my search.
This will be a two way because search it searches and your index responds with.
The results.
Similarly, there will be two way from the user.
When I say two way, it's like visual representation of that data is querying and is getting a response
in visualization.
This is our typical architecture.
I know this looks ugly.