Ingest-Tier Scaling

Ingest-Tier Scaling helps customers enable remote queues and route Splunk pipeline data through a smart bus or message broker system. This approach decouples ingestion and indexing, offering several benefits such as a scalable ingestion plane, enhanced data safety, and less queue blockage in the forwarding plane. In Splunk Enterprise 10.2 and higher, existing Splunk indexer clusters can leverage the benefits of Ingest-Tier Scaling.

System / Hardware Requirements

To enable Ingest-Tier Scaling, customers need to add the following:

• A cloud-hosted message queue like Amazon SQS or Azure Storage Queue
• A SmartStore bucket in Amazon S3 or Azure Blob Storage
• Configure a Key Management System (KMS) key for Amazon or an equivalent for Azure
• For multisite deployments, create the smart bus queue and smart store per site