When you first started Splunk, you probably installed it on one machine, imported some logs, and got to work searching. It is wonderful that you can try out the product so easily, but once you move into testing and production, things can get much more complicated, and a bit of planning will save you from trouble later.
In this chapter, we will discuss the following topics:
- Getting data
- The different parts of a distributed deployment
- Distributed configuration management
- Sizing your installation
- Security concerns
- Backup strategies
