Splunk architecture
At enterprise level it is rare to deal with a distributed deployment as opposed to a clustered deployment (and depending on the scale of your systems, the cluster and Disaster Recovery (DR) / High Availability (HA) components of Splunk will be pretty large). It's usually a good idea to use DNS addresses, hardware load balancing, and clustering (both search tier and indexing tier clusters) in order to meet all of the enterprise level DR/HA policies. In an enterprise level network, there are plenty of security restrictions that won't allow data to flow freely to Splunk from one source or another, and in this case, I am going to attempt to give some insight and an example of what has been used previously and does work in order to distribute data to different environments within an enterprise deployment. There are far too many aspects to Splunk architecture to cover in a single chapter, so I will use those that are relevant to the concept of a data router.
