topic Re: Architecture in Splunk Search

Architecture

revanthammineni — Tue, 05 May 2020 04:27:41 GMT

Can Deployer and Deployment server be on a Single instance? What are Management servers in Splunk?

Re: Architecture

esix_splunk — Tue, 05 May 2020 08:28:46 GMT

My response is based on the assumption that you mean can these be deployed on their own dedicated standalone instances as a single role as described.

Yes, the deployer (for SHC) and the Deployment Server can be on a dedicated instance. This can be a virtual instance, as the system requirements are pretty low. Please follow and maintain the minimum system requirements as noted at Splunk Docs.

Yes, the Deployment Server (DS) can be deployed on a dedicated instance. Per our best practices, we recommend that any DS that servers more then 50 clients should be on a dedicated instance.

Re: Architecture

revanthammineni — Tue, 05 May 2020 19:48:40 GMT

Hey! Thanks for responding. Sorry for not being clear with my question. What I meant was, If we can deploy both deployer and the deployment server on a single instance?

Re: Architecture

MuS — Tue, 05 May 2020 20:23:30 GMT

Hi revanthammineni,

Here is some helpful inside about what are the management components in Splunk : https://docs.splunk.com/Documentation/Splunk/latest/Deploy/Manageyourdeployment#Types_of_management_components

You might notice in the table that it is possible to have the DS and the Deployer component on one server BUT as @esix_splunk correctly mentioned it is not recommended and it is also stated in the docs just above the table:

In some low-use situations, you might
be able to combine more than two
management components on a single
instance, although it is not generally
recommended that you do so. If you
intend to do so, monitor the
performance impacts closely to ensure
that you are not overloading the
instance.

Hope this helps ...

cheers, MuS