topic Chronology of Splunk Deployment in Deployment Architecture

Chronology of Splunk Deployment

sarwshai — Fri, 17 Jan 2020 09:06:53 GMT

I need to build Splunk Distributed Environment, how should i configure the different components. I have License/Cluster Master, Indexers, search head and Deployment Server.

I am thinking of below chronology,

1. License/Cluster Master/Deployment Server
2. Indexers
3. search head
4. Heavy Forwarder

Is it right enough, or is there a better way? Also what precautions/prequisite should i keep in mind while deploying all these?

Re: Chronology of Splunk Deployment

gcusello — Fri, 17 Jan 2020 09:19:37 GMT

Hi @sarwshai,
The order you defined it's correct, I'd change only Deployment Server:

it's correct to start from Master Node/License Master;
Search Peer should be configured immediately after MN (or in the same time);
Then Search Heads;
You can start with Deployment Server when you'll start with the periferals systems (Heavy and Universal Forwarders);
At this point you can start with the Heavy Forwarders;
ath the end you should start with Universal Forwarders.

Only some little hints:

forward the logs of all systems to the indexers,
configure a system as Monitoring Console and configure it: it should be better to use a dedicated server or, if you haven't an heavy load on the Master Node, you could use it, but not DS, Indexers and SHs.

Ciao.
Giuseppe

Re: Chronology of Splunk Deployment

sarwshai — Fri, 17 Jan 2020 09:26:04 GMT

Thanks for the suggestion, one point to clarify. I am planning to configure DS on License/Cluster master itself due to hardware restrictions, will it work smoothly (because planning to keep all managment roles under one server)

Re: Chronology of Splunk Deployment

gcusello — Fri, 17 Jan 2020 10:37:53 GMT

Hi @sarwshai,
No: Deployment Server must be on a dedicated server when it manages more than 50 clients and anyway never can be shared with the Master Node.
You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Planadeployment#Deployment_server_and_other_roles .

When you'll use a Search Head Cluster, you'll be able to configure Deployer on Master Node, but Deployment Server is an Heavy roale and cannot use shared hardware (when more than 50 clients to manage).

Ciao.
Giuseppe

Re: Chronology of Splunk Deployment

sarwshai — Fri, 17 Jan 2020 11:16:23 GMT

Thanks @gcusello for the info.

Re: Chronology of Splunk Deployment

sarwshai — Fri, 17 Jan 2020 11:34:55 GMT

@gcusello , still have one doubt, can i configure DS on Heavy Forwarder instead of License/Cluster master

Re: Chronology of Splunk Deployment

gcusello — Fri, 17 Jan 2020 12:07:10 GMT

I don't like it! but if you cannot use a dedicated server (better!).
Ciao.
Giuseppe