Summary

In this chapter, we covered different types of deployments. We looked at how Splunk Cloud differs from Splunk Enterprise by pointing out some additional benefits (such as lower cost) and some constraints (such as reduced administrative control). We then discussed multisite indexer clusters and how they function. We looked at how hybrid search allows us to search from a search head in a Splunk Enterprise deployment to an indexer cluster in a Splunk Cloud deployment. Finally, we looked at federated search, which improves on hybrid search by allowing us to search different Splunk environments.

In Chapter 12, Container Management, we will look at how we can use containers such as Kubernetes and Docker with Splunk.