Multisite Splunk Deployments and Federated Search
Splunk understands that, for some companies, the basic clustered indexer format does not always work. In some cases, companies may want to cut data center maintenance costs by moving to Splunk Cloud. In other cases, companies may want to increase fault tolerance by extending their Splunk deployment across geographic locations. Some companies may just be so large that one data center is not sufficient and so their data is spread out in different clusters. In this chapter, we will explore several alternative Splunk deployments. We will look at how Splunk Cloud differs from Splunk Enterprise. Then, we will look at how to set up multisite Splunk deployments. Lastly, we will talk about how to search across Splunk deployments using hybrid and federated search.
In this chapter, we will explore the following topics:
- Exploring multisite Splunk deployments
- Configuring federated search
- Using federated search