Splunk Cloud Platformサービスの詳細

Splunkフォワーダーの使⽤

フォワーダーソフトウェアには、ユニバーサルフォワーダーとヘビーフォワーダーの2種類があります。ほとんどの場合、ユニバーサルフォワーダーがSplunk Cloud Platformに最適なフォワーダーです。ユニバーサルフォワーダーにはデータ転送に必要な基本コンポーネントが含まれており、使用するハードウェアリソースも少なく、高い拡張性を備えています。⼀部の使⽤事例において、転送前にデータを解析したり、イベントのソースやタイプなどの指標に基づいてデータを転送する必要があったりする場合には、ヘビーフォワーダーが必要です。Splunk Cloud Platform契約には、Splunkフォワーダーの設定を⼀元管理するためのデプロイサーバーライセンスも含まれています。デプロイサーバーライセンスは、Splunkサポートに要求できます。Splunk Cloud Platform環境に対する設定、有効化、変換、フォワーダーからのデータ送信は、お客様の責任となります。つまり、バージョン互換性の維持を含む、フォワーダーのインストール、設定、および管理は、お客様の責任で⾏ってください。Splunk Cloud Platform環境に転送されるデータをルーティング、フィルタリング、およびマスキングする場合は、Ingest Actionsを利⽤します。詳細は「サポートされるフォワーダーバージョン」を参照してください。Splunk Cloud Platformで使⽤するAppのデータ収集コンポーネントのSplunkフォワーダーへのインストールも、お客様の責任となります。

サービスへのオンボーディングの⼀環として、Splunkはお客様がフォワーダーを使⽤してSplunk Cloud Platformにデータを送信するために使⽤するIPアドレスを提供します。これらのIPアドレスは、契約期間中は変わりません。契約レベルを引き上げた場合は、データを送信するための追加のIPアドレスが提供される場合があります。万が⼀IPアドレスが変更されるような場合には、事前に通知があります。ほとんどのお客様は、データがSplunk Cloud Platformに正常に転送されるように、これらのIPアドレスをアウトバウンドファイアウォールルールに追加する必要があります。アウトバウンドファイアウォールルールのライフサイクル管理を簡素化するため、提供された実際のIPアドレスまたはDNSマッピングを使⽤してください。

スクリプト⼊⼒とモジュール⼊⼒の詳細は「エクスペリエンスの指定」を参照してください。

詳細は、『データの取り込み』マニュアルの「データのアップロード」と「Use the Ingest Actions page ([Ingest Actions]ページの使⽤)」を参照してください。

HTTPイベントコレクター(HEC)の使⽤

HECを使⽤すると、トークンベースの認証モードを使⽤して、データやAppイベントをセキュアHTTP (HTTPS)プロトコルでSplunk Cloud Platformに送信できます。トークンを⽣成し、このトークンを使ってロギングライブラリまたはHTTPSクライアントを設定して、特定の形式でデータをHECに送信します。Splunk Cloud Platform環境では、デフォルトでHECが有効化されており、最⼤コンテンツ⻑は1MBサイズに設定されています。HEC経由でのSplunk Cloud Platform環境に対する設定、有効化、変換、データの送信は、お客様の責任となります。また、データの取り込みが中断しないように、Splunk Cloud Platformから受け取るHECエラーコードを監視して修復する作業もお客様の責任となります。詳細は、以下を参照してください。

• 『データの取り込み』マニュアルの「HTTPイベントコレクターの使⽤」
• 「サービスの制限と制約」の表にある「データ収集」の項⽬
• 「Splunk Cloud PlatformとSplunk Enterpriseの違い」セクション(特に、「インデクサー検出とインデクサー応答確認」の項⽬)

AWS Kinesis Data Firehoseの使⽤

AWSリージョンのSplunk Cloud Platformには、追加のデータ収集オプションがあります。AWS Kinesis Data Firehoseは、完全に管理されたスケーラブルなサーバーレスオプションで、各種のAWSサービスから直接Splunk Cloud Platformにデータをストリーミングするためのものです。お客様のSplunk Cloud Platform環境に対する設定、有効化、変換、データの送信は、お客様の責任となります。Kinesis Data Firehoseサービスを使⽤してデータを取り込む場合、AWS Kinesis Data Firehoseの有効化と設定、そしてこのサービスに関する料⾦のAWSへの⽀払いはお客様の責任となります。詳細は、『Splunk Add-on for Amazon Kinesis Firehose』マニュアルの「Splunk Cloud PlatformデプロイへのSplunk Add-on for Amazon Kinesis Firehoseのインストールと設定」を参照してください。

Edge Processorソリューションの使用

Edge Processorソリューションは、制御および設定がクラウドベースで⼀元的に管理されるSplunkフォワーダーの中継転送層を提供します。⼀部の使⽤事例において、転送前にデータを解析したり、イベントのソースやタイプなどの指標に基づいてデータを転送する必要があったりする場合には、Edge Processorソリューションをヘビーフォワーダーの代わりとして使⽤できる可能性があります。また、Edge Processorソリューションは、フィルタリング、マスキング、およびルーティングの機能も備えています。詳細は、「About the Edge Processor solution (Edge Processorソリューションについて)」を参照してください。

Ingest Processorの使⽤

Ingest Processorは、Splunk Cloud Platformデプロイ内で動作するデータ処理ソリューションです。Ingest Processorを使用すると、データフローの設定、データ形式の制御、変換ルールの適用、インデックス化前のログのメトリクス化、送信先へのルーティングを行うことができます。

このソリューションは、フォワーダーまたはHTTPイベントコレクター(HEC)を使用してデータをデプロイに取り込むSplunk Cloud Platformの管理者に最適です。

Ingest Processorは、Splunk Cloud Platform環境内に追加のインフラストラクチャを必要としないため、簡単にデプロイして利用することができます。また、組織のニーズに応じて、インフラストラクチャリソースをシームレスに拡張および調整します。さらに、中央のSplunk Cloudサービスを通じて、データ処理の設定管理やデータ取り込みトラフィックの監視を行うことも可能です。詳細は、「About Ingest Processor (Ingest Processorについて)」を参照してください。

データ収集に関する追加の情報

データ圧縮

フォワーダーとHTTPイベントコレクターは、TLSプロトコルでデータを送信する場合にデータを圧縮します。圧縮⽐はコンテンツによって異なりますが、⼀般的には8:1～12:1です。

送信中の暗号化

セキュリティを確保するため、送信中のデータはTLS 1.2+で暗号化されます。送信側と受信側は互いに認証を⾏い、HTTPベースのデータ収集ではトークンベースの認証によってセキュリティが確保されます。

Splunkハイブリッドソリューションでオンプレミスコンポーネントを使⽤する場合、オンプレミスコンポーネント間で転送されるデータが暗号化されるのは、接続が暗号化するように設定されている場合のみです。

IP許可リスト

機能固有のドキュメントで特段の注記がない限り、Admin Config Service (ACS)を使⽤して、データ収集元を許可済みのIPアドレスに制限できます。⾃分のSplunk Cloud PlatformリージョンでACSにアクセスできない場合は、Splunkにサポートチケットを申請してください。ACSの詳細は、「Splunk Cloud PlatformのIP許可リストの設定」を参照してください。

関連項⽬

Splunk maintenance responsibilities

The following sections describe the maintenance responsibilities and tasks that Splunk does on your behalf.

Gets you started

When you first subscribe to Splunk Cloud Platform, Splunk sends you a welcome email containing the information required for you to access your Splunk Cloud Platform deployment and get started. This email contains a lot of important details, so keep it handy.

Assists you with supported tasks

Splunk Cloud Platform enables you to customize user, index, and app management through Splunk Web. However, there are features in Splunk Cloud Platform that require assistance from Splunk to activate or make changes to your configurations, such as real-time search and enabling AWS Kinesis Data Firehose data to be received. When you file a support ticket, Splunk will enable such features on your behalf. For these types of customer-initiated changes, it is performed per customer necessity and the customer contact in the Support Case will receive notice of customer-initiated changes once the work is scheduled. During these types of customer-initiated changes, ingest and search services are available but degraded. In most cases, login will be impacted for no more than 10 minutes. You will receive email notices when such maintenance is starting and when it is complete.

Upgrades your software and expands your subscriptions

Splunk will provide the most current compatible version of Splunk Cloud Platform and Premium app subscriptions as Splunk-initiated Service Updates. Maintenance windows for these upgrades will be communicated in accordance with the Splunk Cloud Maintenance Policy.

Note the following operational information regarding Splunk-initiated maintenance windows:

• You can view your maintenance window in ACS and CMC. See View maintenance windows for Splunk Cloud Platform in the Admin Config Service Manual and Review the upcoming maintenance window timeline in the Splunk Cloud Platform Admin Manual.
• Splunk will take no more than two maintenance windows for Service Update Maintenance per calendar month.
• If requested at least 72-hours prior to the scheduled maintenance window, Splunk will make commercially reasonable efforts to honor change requests.
• Splunk will notify your Operational Contacts at least 14 days in advance for Service Update Maintenance. Splunk will notify your Operational Contacts at least 7 days in advance for Security and Platform Maintenance. Maintenance start and completion communications are not currently available for Splunk Initiated Changes.
• Our communications will provide specifics whether any service will be degraded or unavailable plus updates to data ingestion mechanisms and applications required to be performed by you. In certain maintenance situations, data egress of Dynamic Data Self-Storage will be paused during the maintenance window.
• If your Service Update or Security and Platform Maintenance window extends, Splunk will notify you of the extension.
• Emergency Maintenance is performed in circumstances that require immediate attention. We expect these Emergency Maintenance windows to be rare and by its very nature not scheduled. Splunk will make commercially reasonable efforts to notify customer Operational Contacts. Our communications will provide specifics about any required customer actions, such as updates to data ingestion mechanisms or applications.
• Change Freeze requests cannot be made for Emergency Maintenance or Security and Platform Maintenance, and Splunk may override any previously approved Change Freeze requests to perform such maintenance.
• Change Freeze requests will only be considered for customer Splunk Cloud Platform and Premium Apps environments on a version made generally available within the last 12 months.

In addition, we will enhance Splunk Cloud Platform on your behalf, such as increasing the amount of your daily ingestion, adding storage, enabling Premium App subscriptions and Encryption at Rest to Splunk-hosted environments (if applicable).

With Zero Downtime Maintenance, certain operations will be done without a maintenance window:

• Zero Downtime Maintenance operations are performed in the background and will have a minimal impact on data ingestion, login, search, UI, or access to data while the maintenance is in progress.
• Transient error messages may appear on the Splunk user interfaces
• Login sessions will be maintained
• Searches will continue to run and complete throughout Splunk service update
• These operations are not communicated in advance. A historical record upon completion of these changes will be available in CMC and can be viewed through ACS.
• Zero downtime Maintenance will honor Change Freeze, unless they are classified as Security and Platform Maintenance or Emergency Maintenance.

Ensures Splunk Cloud Platform uptime and security

Splunk continuously monitors the status of your Splunk Cloud Platform environment to help ensure uptime and availability. See the Monitoring section. We look at various health and performance variables such as the ability to log in, ingest data, access Splunk Web and perform searches. Splunk maintains the following:

• A rolling 30-day history of health and utilization data to help ensure uptime and assist troubleshooting of your Splunk Cloud Platform.
• A rolling 7-day daily backup of your ingested data and configuration files to ensure data durability. Note that the backups are accessible only by Splunk and at their discretion to leverage as situation dictates.
• The encryption keys when you purchase an encryption at rest subscription. See the Data retention section in Storage.

See also the information in the Users and Authentication section regarding the Splunk Admin and system user roles, and the certification of Splunk Cloud Platform by independent third-party auditors to meet SOC2 Type II and ISO 27001 security standards.

Your maintenance responsibilities

The following section describes your maintenance responsibilities and tasks.

Keep Operational Contacts up-to-date

Ensure that the Operational Contacts listed in your Splunk.com support portal are accurate and updated as necessary. Operational Contacts are notified when your Splunk Cloud Platform environment undergoes maintenance, requires configuration awareness, or experiences a performance-impacting event. These contacts will receive regular notifications of planned and unplanned downtime, including scheduled maintenance window alerts and email updates related to incident-triggered cases.

For more information, see the Splunk Cloud Platform Maintenance Policy in the Service terms and polices section.

Review Splunk Cloud Platform documentation

Splunk will notify your Operational Contacts at least 14 days in advance for Service Update Maintenance, and 7 days in advance for Security and Platform Maintenance. To ensure your Splunk Cloud Platform environment and your team are ready, review the following sections in the Splunk Cloud Platform Release Notes prior to the maintenance:

• New features
• Known and fixed issues

For additional questions around maintenance on your instance, please reach out to your account and/or sales team or Splunk Support.

Federated search for Splunk

Federated search for Splunk allows you to search datasets outside of your local Splunk platform deployment. From your local search head, federated search gives you a holistic view of datasets across multiple Splunk platform deployments. The table lists conditions and limitations that apply to federated search for Splunk. For more information, see About Federated Search for Splunk.

The table lists the conditions and limitations that apply to federated search for Splunk.

Federated search for Amazon S3

Federated search for Amazon S3 is a feature that enables you to search data in Amazon S3 without having to ingest that data into your Splunk Cloud Platform environment. When you use federated search for Amazon S3 you run searches utilizing AWS Glue Data Catalog tables that represent the data in your Amazon S3 buckets. For more information, see About Federated Search for Splunk.

Federated search for Amazon S3 is designed for low-frequency, ad-hoc search of historical data stored in Amazon S3 leveraging the benefits in terms of cost, compliance and scalability that this service provides.

Contact your Splunk sales representative to activate federated search for Amazon S3 on your Splunk Cloud Platform environment. When you do this you will acquire a data scan entitlement that is based on the volume of Amazon S3 data on disk (in terabytes) you are projected to scan over the upcoming year to date. You can track your usage against your entitlement through a Federated Search for Amazon S3 dashboard in the Cloud Monitoring Console.

To use federated search for Amazon S3, you must have the following:

• A Splunk Cloud Platform environment on version 9.0.2305 or higher. Your Splunk Cloud Platform environment must be in an AWS region. Splunk Cloud Platform environments in Google Cloud regions are not supported. FedRAMP Moderate and DOD IL5 environments are supported. Splunk Cloud Platform FedRAMP High environments are not supported.
• Existing Amazon S3 buckets with data that you want to search. Federated Search for Amazon S3 supports data originating from Edge Processors, Ingest Actions, and Ingest Processor. Federated Search for Amazon S3 does not currently support reading data from Dynamic Data Self-Storage or Dynamic Data Active Archive format.
• Permissions to modify access policies for Amazon S3 buckets and AWS Glue Data Catalog tables and databases in your AWS account.

Hybrid search

To examine data in Splunk Cloud Platform and your on-premises deployment of Splunk Enterprise in a single search, you can configure a Splunk Enterprise search head to connect to a Splunk Cloud Platform indexer cluster. This configuration is called hybrid search.

The table lists the conditions and limitations that apply to hybrid search.

See also

App security

All Splunk apps hosted on Splunk Cloud Platform by Splunk are examined by Splunk engineers to ensure that they comply with the Vet apps and add-ons for Splunk Cloud Platform. Splunk Cloud Platform vetting provides a set of best practices for app developers. For details about how to submit an app for evaluation for Splunk Cloud Platform readiness, see the Splunk Developer web page.

Data encryption

All data in transit to and from Splunk Cloud Platform is TLS 1.2+ encrypted. To encrypt data at rest, you can purchase AES 256-bit encryption for Splunk-hosted environments for an additional charge. Keys are rotated regularly and monitored continuously.

Data handling

You can store your data in one of the available AWS or GCP regions. See Available regions and region differences for global regions supported in the Splunk Cloud Platform service.

Data is kept in the region you choose. If you need to store your data in more than one region, you can purchase multiple subscriptions. Data is retained in Splunk Cloud Platform according to the volumes, durations, and index configurations you set. Expired data is deleted based on your pre-determined schedule.

For the purposes of disaster recovery, your configuration and recently-ingested data is backed up on a rolling seven-day window. If you require your ingested data to be moved into your control before the termination of your subscription, this is accomplished through a Splunk Professional Services engagement. Some data can be moved into your control by enabling Dynamic Data Self-Storage to export your aged data to your Amazon S3 or Google Cloud Storage account in the same region. Note that Dynamic Data Self-Storage does not export your configuration data. Depending on the amount of data and the work involved, we may charge for this service. For more information on Splunk Cloud Platform data management, see Review Splunk Cloud Platform data policies and also Manage Splunk Cloud Platform indexes in the Splunk Cloud Platform Admin Manual.

Instance security

Every Splunk Cloud Platform deployment runs in a secured environment on a stable operating system and in a network that is hardened to industry standards using a default-deny firewall policy, which permits access only to specific IP addresses and services. Your deployment is regularly scanned for host- and application-level threats.

Isolation of data and service

In the cloud, your data is logically isolated from other customers' data, so your performance and data integrity cannot be affected by other customers who are using the Splunk Cloud Platform service.

Security controls and background screening

Splunk security controls are described in our most recent Service Organization Control II, Type II Report (SOC 2/Type 2 Report). For more information about regions for which Splunk does not have SOC2 controls in place, see the Splunk Cloud Platform Security Addendum. Splunk conducts criminal background checks on its employees prior to hire, as permitted by law.

User authentication and access

You can configure authentication using Lightweight Directory Access Protocol (LDAP), Active Directory (AD), and single sign-on using any SAML v2 identity provider. To control what your Splunk Cloud Platform users can do, you assign them roles that have a defined set of specific capabilities. Splunk Cloud Platform enables you to configure account policies that require unique user names, minimum password length, and regular password resets with supported SAML v2 identify providers and LDAP. To enable multifactor authentication, customers must configure a SAML v2 identity provider that supports multifactor authentication. Only SHA-256 signatures in the SAML message between your IdP and Splunk Cloud Platform are supported.

If authentication and access methods for a feature differ from the above, it will be documented in the feature-specific Documentation.

See also

関連項⽬

Platform service limits (hard limits)

You can use this list as guidance to ensure the best Splunk Cloud Platform experience. You are unable to exceed these hard service limits.

Tested and recommended service limits (soft limits)

You can use this list as guidance to ensure the best Splunk Cloud Platform experience. If you exceed these soft service limits and have a degraded experience, Splunk may recommend you reduce to below the tested or recommended limit as part of service remediation.

Data retention

When you send data to Splunk Cloud Platform, it is stored in indexes and you can self-manage your Splunk Cloud Platform indexes settings using the Indexes page in Splunk Web. Splunk Cloud Platform retains data based on index settings that enable you to specify when data is to be deleted. To configure different data retention settings for different sources of data, store the data in separate indexes according to the desired retention policy. You can configure different data retention policies for individual indexes according to your auditing and compliance requirements.

Each index lets you specify the maximum age of events in the Index (specified in the Retention (days) field on the Indexes page) that the service uses to determine when to delete data. When the index reaches the specified maximum size or events reach the specified maximum age, the oldest data is deleted. When data is deleted from the index, it is no longer searchable by Splunk Cloud Platform.

The following are the types of storage available in a Splunk Cloud Platform subscription:

• Dynamic Data Active Searchable (DDAS) is used for searching ingested data. DDAS is also commonly known as searchable storage. You can optionally purchase additional DDAS in 500 GB increments.
• Dynamic Data Active Archive (DDAA) is used as a long term storage and data in DDAA can be restored to DDAS to be searched. You can optionally purchase additional DDAA in 500 GB increments.

For both DDAS and DDAA, you can choose to have your data encrypted at rest using AES 256-bit encryption for an additional charge. If you choose encryption at rest, Splunk manages the encryption keys on your behalf by default. If available in your region, you have the option to manage the encryption keys instead.

You can review your storage consumption in the Cloud Monitoring Console app included in your Splunk Cloud Platform environment. The app provides information such as the amount of data stored and the number of days of retention for each index.

For more information about the data that Splunk retains and maintains on your behalf, see the Ensures Splunk Cloud Platform uptime and security section in Splunk maintenance responsibilities.

Dynamic Data Active Searchable (DDAS)

DDAS in your Splunk Cloud Platform environment should be sized based on the volume of uncompressed data that you want to index on a daily basis. For workload-based subscriptions, you purchase DDAS based on your data retention requirements that provide you the flexibility to tailor the variability in your use case. For example, if your forecasted daily volume of uncompressed data is 1 TB and your searchable retention need is 365 days, your Splunk Cloud Platform environment should be sized to have 365 TB of DDAS. Refer to the Splunk General Terms for Splunk's policy for Overages. Ingest-based subscriptions include sufficient DDAS to allow you to store up to 90 days of your uncompressed data. For example, if your daily volume of uncompressed data is 100 GB, your Splunk Cloud Platform environment will have 9000 GB (9 TB) of DDAS. Note the following:

• If you ingested far more data than your initial estimate and thus exceeded your entitled DDAS capacity, the Splunk Cloud Platform service elastically expands the amount of DDAS to retain your data per your retention settings.
• While DDAS is elastically expanded to ensure your data does not prematurely age out, consistently over ingesting beyond estimated may impact search performance.

Dynamic Data Active Archive (DDAA)

If you require a lower cost option for long term storage of data, you can optionally augment Splunk Cloud Platform with DDAA. As data ages from DDAS based on your index retention setting, the aged data is automatically moved to DDAA before deletion. Data remains in DDAA until the DDAA retention setting that you specify expires.

Your DDAA subscription enables you to perform restores, subject to the amount of DDAS you have purchased as part of your Splunk Cloud Platform subscription. An additional 10% of DDAS is included with your DDAA subscription to assist with restores. The 10% is calculated based on the total DDAS amount in your subscription. For example, a workload-based subscription that has a 10 TB DDAS entitlement will have an additional 1 TB of DDAS added with a DDAA subscription, effectively increasing the DDAS entitlement to 11 TB. Note that this additional 1 TB should be considered as reserved for DDAA restores, as any restore volumes that result in surpassing the DDAS entitlement may incur a true-up cost.

Note the following:

• Restored DDAA data is typically ready to search within 24 hours after a restoration request and remains searchable for up to 30 days.
• Large amounts of DDAA data restore can take beyond 24 hours to complete.
• Multiple restores that overlap within a 30-day period will accrue against the additional 10% of searchable storage included with your DDAA subscription.
• Refer to the Splunk General Terms for Splunk's policy for Overages.

Dynamic Data Self-Storage (DDSS)

You can also export your aged data from Splunk Cloud Platform. If you enable Dynamic Data Self-Storage (DDSS) to export your aged ingested data, the oldest data is moved to your Amazon S3 or Google Cloud Storage account in the same region as your Splunk Cloud Platform deployment before it is deleted from the index.

Note the following:

• You are responsible for payments for your use of Amazon S3 or Google Cloud Storage.
• Aged data is exported unencrypted to your Amazon S3 or Google Cloud Storage account.
• DDSS data stored in S3 cannot be searched by Federated Search for Amazon S3 at this moment.

See also

Workload-based subscription

This subscription is based on the resource capacity consumed rather than the data volume ingested. Your subscription entitles you to the purchased workload resources and this subscription does not meter ingestion. You can increase ingest and/or search load and operate the service to your desired performance objective. As necessary, you can purchase additional resource capacity to increase ingest and search load or to improve performance. You purchase units of storage blocks based on your data retention requirements for your workload-based subscription. If you ingested far more data than your initial estimate and thus exceeded your purchased storage capacity, the Splunk Cloud Platform service elastically expands the amount of storage to retain your data per your retention settings. Refer to the Splunk General Terms for Splunk's policy for Overages. The Cloud Monitoring Console and Splunk Web provide you with the total amount of data retained at any given time.

Ingest-based subscription

By exception, you may be on an ingest-based subscription. An ingest-based subscription for Splunk Cloud Platform is based on the volume of uncompressed data that you want to index on a daily basis. The subscription pricing also includes a fixed amount of data storage. If you ingest more data than your entitlement and thus exceed your storage entitlement, the Splunk Cloud Platform service elastically expands the amount of storage to retain your data per your retention settings. Refer to the Splunk General Terms for Splunk's policy for Overages. The Cloud Monitoring Console and Splunk Web provide you with the total amount of data retained at any given time.

Data policies

Splunk Cloud Platform administers your data according to the following policies:

• Your workload-based subscription entitles you to the purchased workload resources and this subscription does not meter ingestion.
• Your Splunk Cloud Platform ingest-based subscription governs how much data you can load into your Splunk Cloud Platform deployment per day (GMT). You can exceed your ingest-based subscription daily index volume a maximum of five times in a calendar month. If you exceed your daily limit more than five times in a calendar month, your Splunk sales representative may work with you to help you reduce your usage to stay within the purchased limit or to purchase the necessary increase. If you are unable or unwilling to abide by the applicable usage limit, you will pay any invoice for excess usage in accordance with your Terms of Service. If you consistently exceed your ingest-based subscription limit, contact Splunk Sales to do a benchmark assessment to determine your volume needs and purchase an appropriate plan to handle your volume.

To see current and past daily data ingestion information in Splunk Web, use the Cloud Monitoring Console app. For more information, see Locate the Cloud Monitoring Console and Use the License Usage dashboards. Splunk recommends you set up alerts in the system to monitor your license usage.

Subscription expansions, renewals, and terminations

You can expand aspects of your Splunk Cloud Platform subscription anytime during the term of the subscription to meet your business needs. You can optionally add subscriptions to do the following:

• Increase your workload-based or ingest-based subscription level.
• Add additional storage capacity in 500 GB increments to store more data.
• Add encryption services to Splunk-hosted environments to help maintain the privacy of data at rest.
• Add a HIPAA or PCI DSS cloud environment to assist you with meeting your compliance needs.
• Add new use cases for Splunk Cloud Platform with Splunk premium solutions such as Enterprise Security (ES) and IT Service Intelligence (ITSI). With workload-based subscriptions, the unit of measurement is in SVC for both entitlements. With ingest-based subscriptions, the unit of measurement is in GB for both entitlements.

You will receive renewal notifications starting 60 days prior to the end date of your current subscription term. For more information on subscription renewals, contact your Splunk sales representative. If your Splunk Cloud Platform subscription expires and no temporary extension is submitted on your behalf by your Splunk sales representative, it is considered terminated. The policy for terminated Splunk Cloud Platform subscriptions are the following:

• Your ability to perform searches stops immediately.
• Your ability to ingest data stops 7 days following termination.
• Your data is deleted 60 days following termination.

If you require your ingested data to be moved into your control before the termination of your subscription, this is accomplished through a Splunk Professional Services engagement. Some data can be moved into your control by enabling Dynamic Data Self-Storage to export your aged data to your Amazon S3 or Google Cloud Storage account in the same region. Note that Dynamic Data Self-Storage does not export your configuration data. If you choose to use Dynamic Data Self-Storage to export your aged ingested data, you must do so prior to termination of your subscription. You are responsible for AWS or Google Cloud Storage charges you incur for your use of Amazon S3 or Google Cloud Storage.

Current Splunk Cloud Platform and Premium App versions

Splunk determines which versions of Splunk Cloud Platform and Premium Apps to make available to Splunk Cloud Platform subscribers. Splunk adopts the release that has the most benefits for customers as quickly as possible. The table lists the current versions for Splunk Cloud Platform and Premium App subscriptions.

Splunk Cloud Platform versions have the following release numbering format that is unique and not available for Splunk Enterprise: [Major Release].[Minor Release]. [Release Date]

Supported forwarder versions

The following are the supported forwarder versions for Splunk Cloud Platform. This information is applicable to universal and heavy forwarders that are communicating directly to Splunk Cloud Platform. If you have deployed an intermediate forwarder tier communicating directly to Splunk Cloud Platform, the following information applies to the forwarders in the intermediate tier instead of the forwarders indirectly connected. If you are unable to upgrade forwarders that communicate directly to Splunk Cloud Platform, you accept the risk of continuing to use forwarder versions that have reached their end of support date.

* Each minor version of Splunk Universal Forwarder is Supported from release for a total of 60 months. During the first 24 months from release of each version, the targeted Support response times will be determined by issue severity and priority. For the subsequent 36 months, the targeted Support response times will be limited to the P3 level.

Supported hybrid search versions

The table lists the supported on-premises Splunk Enterprise versions for Splunk Cloud Platform hybrid search configurations. This information is applicable to on-premises search heads that are communicating directly to Splunk Cloud Platform environments, also referred to as hybrid search heads. In order to be eligible for support, your on-premises search heads must be on the same major version (e.g. 9.0.x) as your Splunk Cloud Platform environment. If you are unable to upgrade the hybrid search heads that communicate directly to Splunk Cloud Platform to the supported versions, you accept the risk of continuing to use search heads that have reached their end of support date.

Supported Python versions

The table lists the supported Python interpreters for Splunk Cloud Platform. For more information on Python 2.x deprecation and support on Splunk Cloud Platform, see Python 3 migration with the Splunk platform.

関連項⽬

関連項⽬