As an organization deploys Splunk, it will have specific requirements related to the architecture, its resiliency, and disaster recovery.
Splunk architecture considerations
Splunk architecture for an organization
Usage, data volume, and criticality are the three biggest determinants of how much hardware you need in your Splunk environment. If you have large data volumes, a single server may not have enough processor capacity to index and provide searching together. Alternatively, consider the notion of installing Splunk on a single server. If that server were to fail, your Splunk application would fail along with it. If Splunk becomes a critical part of the organization, the cost of server failure may outweigh the costs of...
