Last year, at the Container Strikes Back session, Brent Boe and Brian Bingham introduced the new Splunk official container. Today, we’re talking about the benefits as well as the challenges we encountered adopting the “Splunk in containers!” strategy at the Ministry of Defence for both our testing and our production environments. Our small DevOps team tasked with deploying Splunk did not have the bandwidth to build a resilient and scalable Splunk deployment in a traditional way at the pace required. By consuming the official Splunk Docker image, taking advantage of SmartStore backed by AWS S3, making a liberal use of other AWS services, and with support from Splunk PS architects as well as communities around Splunk’s official GitHub repos, we were able to rapidly deploy a complex Splunk cluster in AWS with minimal overhead. This has allowed our project to keep to our tight deadlines around cloud migration, while also providing a monitoring platform that can be scaled out over time as adoption increases.
Slides PDF link - https://conf.splunk.com/files/2019/slides/IT2009.pdf?podcast=1577146210