About Applied Splunk Validated Architectures

Applied Splunk Validated Architectures (ASVAs) are reference architectures giving a broader solution focus encompassing one or more SVAs. In the same way that SVAs are useful tools to achieve the best architecture, the Applied SVAs provide useful guidance for more complex architectures that need specific use case implementation of one or more "core" SVAs.

If you are new to Splunk, we recommend first understanding and implementing a Validated Architecture for your initial deployment before implementing an Applied SVA. If you are an existing customer, we recommend that you explore the Applied SVA, and then ensure that you understand and align your architectures with the underpinning Validated Architecture topology.

It is always recommended that you involve Splunk or a trusted Splunk partner to ensure that the recommendations in this document meet your needs.

If you need assistance implementing a Splunk Validated Architecture, contact Splunk Professional Services.

What to expect from Applied Splunk Validated Architectures

As per SVAs, Applied SVAs do not include deployment technologies or deployment sizing. The reasoning for this is as follows:

• Deployment technologies, such as operating systems and server hardware, are considered implementation choices in the context of SVAs. Different customers will have different choices, so a generalization is not easily possible.
• Deployment sizing requires an evaluation of data ingest volume, data types, search volumes and search use cases, which tend to be very customer-specific and generally have no bearing on the fundamental deployment topology. When you are ready, please reach out to Splunk for help with properly sizing your deployment based on your expected ingest and search workload profile.

Summary of current Applied SVA Guidance

SVAs provide:

SVAs do not provide:

Deployment options based on Core SVAs Diagrams of the reference architecture Best practices for building out your Splunk deployment Guidelines and suggestions on different topologies for similar use cases or deployments within the scope of the Applied SVA Considerations for when to use / not use the architecture Benefits and limitations of the Applied SVA (when they are outside those boundaries of the core SVA) Indications for which SVA is/can be incorporated in the Applied SVA

Implementation choices (OS, bare metal vs. virtual vs. Cloud etc.). Deployment sizing. A prescriptive approval of your architecture. Note: SVAs provide recommendations and guidelines, so you can ultimately make the right decision for your organization. A topology suggestion for every possible deployment scenario. In some cases, unique factors may require a custom architecture to be developed. Splunk experts are available to help with any custom solutions you need. If you are an existing customer, reach out to your Splunk Account Team. If you are new to Splunk, you can reach us here.