topic Deployment server in Deployment Architecture

Deployment server

annebeate — Wed, 29 Jan 2014 10:48:32 GMT

Hi,

We are planning to migrate our Splunk environment to new servers and in the same process upgrade from version 5.01 to the latest version (6.01). We are currently using deployment server to distribute configuration to splunk universal forwarders. My question is: can a deployment server receive it's configuration from another deployment server? That is, can a deployment server act as both a deployment client and a deployment server? We currently have aprox 150 Splunk universal forwarders. We are planning to use intermediate forwarders between the splunk universal forwarder and the index servers.

Best regards,
Anne

Re: Deployment server

alacercogitatus — Wed, 29 Jan 2014 12:15:52 GMT

Short answer: Yes.

Long answer: I wouldn't, but it is possible. It's all a matter of whitelists and app assignments. I'm curious - why the intermediate forwarders? Splunk works best with direct connections to the indexers. I have 2 intermediate heavy forwarders - they are used for syslog processing as well as some JMX and ActiveQueue stuff - not traffic control.

Come to IRC! Meet us in #splunk on EFNet!

Re: Deployment server

annebeate — Wed, 29 Jan 2014 13:40:49 GMT

Thanks 🙂 We found a recommendation to use intermediate forwarders in this document: http://www.aplura.com/docs/Splunk_Best_Practices.pdf.

Re: Deployment server

alacercogitatus — Wed, 29 Jan 2014 14:25:57 GMT

Not sure if you need that for your environment - although I do recommend the syslog-ng approach with a Heavy forwarder. It could be best for you, I'd have to know more :D. If your question has been answered, please accept it. Thanks!

Re: Deployment server

alacercogitatus — Fri, 31 Jan 2014 15:42:53 GMT

If this answered your questions, please mark it accepted. Thanks!