Centralized management

dani9 — Thu, 07 Nov 2019 13:56:02 GMT

A way to implement centralized management from web-GUI on SH of main configuration like forwarder, data retention, etc ?

Re: Centralized management

richgalloway — Thu, 07 Nov 2019 18:42:49 GMT

Forwarders are managed at Settings->Forwarder Management on your Deployment Server (DS).
Data retention is managed at Settings->Indexes in a standalone environment or in indexes.conf on the Master Node (MN).
Both DS and MN can be on the SH instance, but this is not best practice.

Re: Centralized management

gcusello — Fri, 08 Nov 2019 08:38:12 GMT

Hi dani9,
you canno use only one centrilezed console to manage Splunk infrastructure, you have to use more servers:

Forwarders are managed using Deployment Server that must stai on a dedicated server (if you have to manage more than 50 targets) and never an Indexer or a Search Head or the Master Node;
Indexers' cluster are managed using the Masted Node that can stay on a shared server but if you have many logs to index Splunk hints to use a dedicated one (it's an Heavy role);
Search Heads are managed by Deployer, that can stay on a shared server (it isn't an heavy role!);
License Master can stay on a shared server (it isn't an heavy role!);
Monitoring Console can stay on a shared server (it's an heavy role!).

So you have at least to use two or three servers for your monitoring consoles.

You can find these indications in Splunk docs in every section (Indexers Cluster, Search Heads Cluster, Deployment Server):
https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Systemrequirements#Additional_roles_for_the_master_node
https://docs.splunk.com/Documentation/Splunk/8.0.0/DistSearch/SHCdeploymentoverview
https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Planadeployment#Deployment_server_and_other_roles

Ciao.
Giuseppe

topic Centralized management in Deployment Architecture

Centralized management

Re: Centralized management

Re: Centralized management