back to day 8
WEEK_2 · DAY_08 · LAB
Lab 8 — Architect a Splunk Deployment
Indexers, search heads, forwarders, deployment server, license master
LAB PROGRESS0/4 steps · 0%
Lab Objectives
- ›Identify every component of a Splunk deployment
- ›Understand the data pipeline: input → parsing → indexing → search
- ›Differentiate Universal Forwarder vs Heavy Forwarder
- ›Plan a clustered deployment
Lab Instructions
- 1Plan a deployment for 500 GB/day ingest.
- 2Size indexers, search heads, forwarders.
- 3Decide: Indexer Cluster yes/no? Search Head Cluster yes/no?
- 4Document on which components Splunk ES would run.