Splunk企业级AWS部署：ELB类型选择及子网部署位置咨询

Great question—let’s break this down specifically for your Splunk Enterprise deployment on AWS, since Splunk has unique traffic patterns that dictate the right ELB choices.

First, let’s cut to the chase: Application Load Balancer (ALB) is the go-to choice for most Splunk Enterprise deployments, with Network Load Balancer (NLB) as a niche alternative. Here’s why:

Application Load Balancer (ALB) #

This is ideal for 90% of Splunk use cases because:

• It natively handles HTTP/HTTPS traffic, which powers Splunk’s core interfaces:
  • Splunk Web (usually secured via HTTPS on port 443, default HTTP on 8000)
  • HTTP Event Collector (HEC, port 8088)
  • Splunk REST API endpoints
• You can configure SSL termination directly on the ALB, offloading certificate management from your Splunk servers and simplifying security updates.
• Layer 7 routing capabilities let you split traffic intelligently: for example, route /services/collector (HEC) traffic to your indexer cluster, and root path (/) traffic to your search head cluster.
• It supports custom health checks tailored to Splunk—you can point it at https://<splunk-server>/services/server/health to verify if a Splunk node is fully operational, not just if the port is open.

Network Load Balancer (NLB) #

Use NLB only if you have high-throughput TCP/UDP traffic that doesn’t fit ALB’s use case:

• If you’re ingesting large volumes of TCP-based syslog (port 514) or raw TCP events into Splunk indexers
• When you need ultra-low latency (single-digit milliseconds) for high-volume event ingestion
• For non-HTTP protocols that Splunk supports, like TCP-based data inputs

Classic Load Balancer (CLB) #

Avoid this entirely—it’s deprecated by AWS, lacks the advanced features of ALB/NLB, and won’t receive future updates. There’s no scenario where CLB is better for a modern Splunk deployment.

The subnet placement depends on whether your Splunk deployment needs external access, but here are the hard rules and best practices:

• Deploy in public subnets for external-facing traffic
  If your team needs to access Splunk Web from outside your AWS VPC, or if HEC needs to receive events from external sources (like on-prem systems or SaaS tools), your ELB must live in public subnets. These subnets have a route to an Internet Gateway (IGW), allowing external traffic to reach the ELB.
  Critical note: Keep your Splunk nodes (search heads, indexers, deployers) in private subnets—never expose them directly to the public internet. Use security groups to allow only the ELB’s security group to communicate with your Splunk nodes.

• Always use multiple Availability Zones (AZs)
  AWS requires ELBs to be deployed across at least two AZs for high availability, and this is non-negotiable for Splunk (a critical logging/monitoring tool). Deploy one ELB subnet per AZ where your Splunk nodes are located. If one AZ goes down, the ELB automatically routes traffic to healthy nodes in other AZs.

• Ensure sufficient IP space in subnets
  ELBs create elastic network interfaces (ENIs) to handle traffic, so your subnets need enough available IP addresses. For most Splunk deployments, a /24 subnet (256 IPs) per AZ is safe—avoid small subnets like /28 (16 IPs) which can run out of space as your traffic scales.

• Align security groups with subnet placement

  • ELB security group: Allow inbound traffic from trusted sources (e.g., your corporate IP range for Splunk Web, public internet for HEC if needed) on the relevant ports (443, 8088).
  • Splunk node security groups: Allow inbound traffic only from the ELB’s security group on the ports Splunk uses (8000, 8088, etc.). This locks down access to your Splunk cluster to just the ELB.

• For Splunk search head clusters: You don’t need session stickiness on the ALB—Splunk’s internal cluster load balancing handles user sessions automatically.
• If you’re using HEC, consider pairing your ALB with AWS WAF to filter malicious traffic, block excessive requests, and enforce rate limits to protect your indexers.

内容的提问来源于stack exchange，提问作者Rohit Sharma