Splunk Cloud Overview Flashcards
What does Splunk Cloud provide?
- Hosted and supported by Splunk
- Enterprise functionality and features hosted on someone else’s machines
- Reliability for data processing and search
- Faster time to value with Splunk managed environment and hosted software. Reduced infra investment.
Splunk Cloud deployment is ______.
Automated, highly flexible, and scalable.
True or False: Splunk Cloud has the same components as Splunk Enterprise.
True.
What are the components of Splunk?
- Universal and/or Heavy Forwarders
- Search Head
- Indexer(s)
- Manager Node
- License Manager
What components of a Splunk Cloud deployment are considered on-prem/customer cloud?
- Universal/Heavy Forwarders
- Optional Intermediate UF/HF
What components of a Splunk Cloud deployment are considered hosted?
- Search Head(s)
- Indexer(s)
- Manager Node
- License Manager
What is required to access Forwarders?
SSL secure connection access.
What are customer responsibilities in a Splunk Cloud deployment?
- Forwarding data to Splunk
- Managing configurations such as source type, index and contextual details
- Administer and coordinate changes to manage users, data retention, config and maintenance, license, ingestion, etc.
What aspects of a Splunk Cloud deployment are managed by Splunk?
Reliability.
- Ingestion and data management
- Indexing and storage of data
- Searchable data access
What licensing options are available to Splunk Cloud customers?
- Ingestion based
- Infrastructure usage-based
How is license option determined for a customer?
Based on:
- Current and future ingestion size
- Correct sizing calculated on potential workload
- Need for flexibility and scalability
Ingestion violations are _____.
Not enforced.
They are monitored and adjustments to volume or infrastructure resourcing is done on:
- Usage review of consumption
- To meet performance challenges and customer growth.
How does ingestion licensing work?
Aggregated daily volume of data indexed as GB/day of data ingest.
- All Splunk capabilities at a set cost for ingesting data
- No additional costs to increase resources for index or search activities.
- Additional data can be purchased to the next ingest level available or to unlimited data volumes.
How does workload/infrastructure licensing work?
Splunk Virtual Core (SVC) units of data processing capacity used for a mix of ingest and search.
- All Splunk capabilities at a set cost of a fixed size infrastructure deployed.
- No ingestion violation - allowed unmetered ingest
How are Splunk Virtual Cores (SVCs) measured?
SVCs are measured as units of Compute, Memory, and I/O resources consumed by Splunk processes.
