Atlas Deployments Overview

There are three supported Deployment Architectures of the Atlas product. This page will outline each of the Deployment Architectures and link to their extended documentation. If Atlas is deployed or utilized utilizing a methodology not described below, certain features may not operate as expected. Please contact Expertise on Demand with any questions.

Standard Deployment

In the Standard Deployment, Atlas is directly installed on the Search Head tier of the Splunk environment. In a Splunk All In One deployment this is directly on the singular Search Head. In a clustered environment, this is on each Search Head, along with additional TAs installed on the Indexing tier. This deployment gives the greatest functionality and does not require any connection to the internet.

Dedicated Deployment

In the Dedicated Deployment, Atlas is installed on a Splunk Search Head meeting minimum requirements that is not part of the production Search Head cluster, and instead is a Search Peer to it. This is in addition to Atlas TAs being installed on the Indexing tier. This will create an Atlas deployment capable of investigating, and in some cases, interacting with the production Splunk cluster, but will have limited functionality. The benefit of this deployment is that any Atlas use does not impact standard processes on the production cluster, however there is some functionality that can't be performed due to the separated instances. This deployment only requires a connection to the production cluster.

Splunk Cloud Deployment

If you're Splunk Search Head is a Splunk Cloud deployment, then this deployment strategy is necessary. The Splunk Cloud Deployment largely mimics the Dedicated Deployment, with an on-premise Atlas Search Head with a connection to the internet so that it can be a Federated Search Head to your Splunk Cloud deployment. Like the Dedicated Deployment, some functionality will not be enabled due to this separation.