Deploy

Deployment scenarios and best practices.

Best practices area

Use the Best practices area to learn about configurations from the Splunk community. Share your own scenarios, or read about how others have set up Splunk deployments.

Participate and contribute

The contents of this wiki are created by Splunk and the Splunk community. We welcome your feedback and contributions.

You're encouraged to add to the topics you find within the sections below, or to create your own topics by linking from the pages inside each area. The Splunk Community Wiki is a MediaWiki (like Wikipedia). Use the Mediawiki online help if you need to know how to add and edit pages.

Signing your posts

When you contribute, please consider signing and dating your post or addition. You can do this easily by including four tildes (~) on a line by themselves.

Questions?

If you have questions about how to contribute to this Wiki, contact rachel@splunk.com. If you have technical questions about running Splunk, you may wish to visit the Splunk user forums or submit a case with Splunk support.

Migration experiences

Have you migrated a large Splunk deployment from 3.x to 4.x? Besides the overview provided in the Installation Manual, there's a lot to a Splunk migration, and we'd like to hear from you about it. Other Splunk users can also benefit from your experience and pointers.

Share your migration tips here

Best practices and processes

Here are some best practices and processes:

• Considerations for deciding how to get data from Windows hosts
• Use Splunk alerts with scripts to create a ticket in your ticketing system
• Best practices for backing up your Splunk data
• How summary indexing can help you

» More best practices and processes

Developing GUI components for Splunk 4.0?

Visit the 4.0 Splunk GUI development page! If you've done something cool with 4.0 GUI development, show us how you did it.

Examples from the field

And here's how some people have done it:

• A multi-tenant scenario with minimal use of hardware
• A hardened Splunk deployment with high security requirements

Deployment information

This section contains information about the components of a Splunk deployment, your options when deploying, what choices you have with respect to high availability, and information about tuning factors.

• Components of a Splunk deployment
• Planning your Splunk deployment
• Deployment considerations for data inputs
• Deployment configuration options:
  • Deployment models with a single Splunk indexer
  • Deployment models with multiple Splunk indexers
  • High availability and Splunk
• Splunk tuning factors
• Hardware tuning factors

Want to know the best way to do something with Splunk?

Tell us what you'd like to see next. If it's not already in Best practices and processes, add your request to the Wish list.

Special Pages » New pages | Recent changes     Contribute » How can you contribute? | Think you've found a bug?