topic Re: Splunk Practical Deployment Lab in Deployment Architecture

Splunk Practical Deployment Lab

shabamichae — Thu, 27 Feb 2025 03:44:46 GMT

I am a Splunk Enterprise Certified Admin who has an opportunity to advance to Splunk Architect. Im planning on taking the Splunk Lab. I am preparing for my Splunk architect practical Lab. Please i want to ask ,

In the practical Lab exam, is it acceptable to have only one instance run as The Deployment Server, License Master and the Monitoring Console on the same port on the management system

Or I am expected to run different Three Splunk instances working on different ports (Deployment server, License Master and on the monitoring console) on the Management System

Re: Splunk Practical Deployment Lab

kiran_panchavat — Thu, 27 Feb 2025 05:38:30 GMT

@shabamichae

I think this is a small deployment, installing the LM and MN on the same instance will work. This approach is practical for lab environments and smaller deployments, as it reduces resource overhead.

Re: Splunk Practical Deployment Lab

gcusello — Thu, 27 Feb 2025 06:59:26 GMT

Hi @shabamichae ,

this is a lab environment so it isn't mandatory to have different servers for the three roles.

Also because you need a dedicated DS only if you need to manage more than 50 clients and in the lab you have few clients.

In addition, in general only the DS requires a dedicated server, License Master and Monitoring Console can share the same machine.

Anyway, in the lab, the exercise says to you which solution you have to use. and they are both useful (in the lab!).

Ciao.

Giuseppe

Re: Splunk Practical Deployment Lab

shabamichae — Thu, 27 Feb 2025 12:42:30 GMT

Thanks @kiran_panchavat
So, if I get you correctly, In the practical Lab exam, I can run Deployment Server, License Master and the Monitoring Console on the same instance with same port

Re: Splunk Practical Deployment Lab

shabamichae — Thu, 27 Feb 2025 12:43:47 GMT

@gcusello
So, if I get you correctly, In the practical Lab exam, I can run Deployment Server, License Master and the Monitoring Console on the same instance with same port

Re: Splunk Practical Deployment Lab

kiran_panchavat — Thu, 27 Feb 2025 12:51:06 GMT

@shabamichae

Yes, you can run the Deployment Server, License Master, and Monitoring Console on the same Splunk instance using the same port (default port 8089 for management). However, there are a few things to consider:

Resource Efficiency: Good for lab environments or small deployments where resources are limited.

Simpler Management: easier to manage since all roles are on a single instance.

Re: Splunk Practical Deployment Lab

shabamichae — Thu, 27 Feb 2025 13:01:26 GMT

Thanks

Re: Splunk Practical Deployment Lab

gcusello — Thu, 27 Feb 2025 13:35:48 GMT

Hi @shabamichae ,

yes, you can do it.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Splunk Practical Deployment Lab

shabamichae — Thu, 27 Feb 2025 16:21:40 GMT

@gcusello Thanks

Re: Splunk Practical Deployment Lab

isoutamo — Fri, 28 Feb 2025 16:19:06 GMT

When you are doing those labs, please remember that you are doing that work for "customer"!

This means that Client have given you already some instructions/plan/architecture how he/she see the result. When there is something confusing or not described enough clearly you should ask it from your Client just like in real life. It's always best to discuss with Client and ensure that both parties have exactly same understanding what you are doing! Worst think what you could do in those labs is make some guesses 😉 Always ask if you are not sure what client wants. You should know how you do it after that.

Re: Splunk Practical Deployment Lab

shabamichae — Sun, 02 Mar 2025 04:04:44 GMT

In the practical Lab environment, how important is it to configure TLS on Splunk servers during the practical Lab, is it mandatory to configure TLS on my environments?

Re: Splunk Practical Deployment Lab

isoutamo — Sun, 02 Mar 2025 17:02:03 GMT

If they don’t tell it, then you should ask it or make assumption 🤔

Re: Splunk Practical Deployment Lab

gcusello — Mon, 03 Mar 2025 08:09:13 GMT

Hi @shabamichae ,

as also @isoutamo said: do only the requested things not anything else!

Ciao.

Giuseppe