An exciting new option for Splunk is Splunk Cloud. This option offers almost all of Splunk's features and functionalities along with the convenience of being on a real cloud platform:
- Readily available online, Splunk lists the following statement as per http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/User/WelcometoSplunkCloud:
"Splunk Cloud provides a layer of security and operational control that causes it to differ from Splunk Enterprise".
In my experience, moving any software or service to the cloud typically will have some implications. With Splunk Cloud, you can expect the following differences (from Splunk Enterprise):
- There is no CLI (Splunk's command-line interface) support. This means that some (administrative) tasks can be achieved through the web browser but most will require Splunk support.
- Only apps that have been assessed (on security and stability) and accepted by Splunk support are allowed to be installed and run in Splunk Cloud.
- If you selected a managed Splunk Cloud, Splunk support must install and configure all apps (self-service Splunk Cloud still allows you to install apps yourself).
- Direct monitoring of TCP, UDP, file, and syslog inputs. Unlike Splunk Enterprise, these data types cannot be sent straight to Splunk Cloud (an on-premises forwarder must be used).
- Scripted Alerts are supported only in approved apps.
- License pooling is not available in Splunk Cloud. The license manager is not internet-accessible to the Splunk Cloud customers.
- Again, for managed Splunk Cloud deployments, the HTTP event collector (HEC) must be set up for you by Splunk.
- Access to the Splunk API is initially turned off (for Splunk Clusters) but can be turned on by Splunk support. To enable API access to Splunk Cloud sandbox(es) and trials, and single instance deployments, you must file a Support ticket (not recommended due to the short duration of trials).