• This guide
  • About the Splunk Deployment Guide
• Splunk components
  • Components of a Splunk deployment
    • Indexer
    • Forwarder
    • Deployment server
  • Data inputs
    • File and directory inputs
    • FIFO queues
    • Network ports
    • Scripted inputs
    • Windows event logs and WMI
• Deployment options
  • Single index server deployment models
    • Splunk installed on existing aggregation host
    • Splunk with direct network inputs
    • Splunk installed on a host receiving batched IT data moves
    • Splunk indexing data on a remote mount / network storage
    • Splunk installed on all servers forwarding data
  • Multiple index server deployment options
    • Distributed search with data balancing
    • Data cloning for high availability
    • Data routing
    • Index and search tiers for massive scalability
  • High availability and Splunk
    • Considerations for Splunk Web objects and user data in high availability
    • Working with load balancers
    • Files to rsync
• Deployment tuning
  • Splunk tuning factors
  • Hardware tuning factors
    • Input / Output
• Capacity planning
  • Splunk benchmarks
    • Benchmark test overview
    • Benchmark tests

About the Splunk Deployment Guide

Splunk supports a wide variety of configurations and deployments to suit the largest scales of IT infrastructure in use worldwide. This guide will assist you in the planning and tuning of a Splunk deployment at any scale.

In addition to this document, you can find many deployment-related articles at the Splunk Deployment Wiki. See how other Splunk users have customized their deployments to meet their needs and add your own experience to the mix!

You can also watch this Splunk developer video which also provides an overview of deploying Splunk.