Scale easily with deployment servers and config files
To support larger environments, where data originates on many machines and where many users need to search the data, you can scale your deployment by installing Splunk across different machines. When you do this, you configure the Splunk instances so that each one performs a specialized task. For example, one or more instances might index the data, while another manages searches across the data. This is known as a distributed deployment.
Splunk provides a deployment server and configuration files to help you manage a distributed deployment and keep the configurations coordinated.
How a deployment server and config files help you scale efficiently
A deployment server is a smart solution to manage a Splunk distributed deployment. Unfortunately, you cannot use a deployment server to manage clustered indexers or search head clusters, or upgrade installations of Splunk. But fear not, we'll come back to these topics in a future email.
Deployment: A set of distributed Splunk instances, working together.
Deployment server: A Splunk instance that acts as a centralized configuration manager, grouping together and collectively managing any number of Splunk instances.
Deployment client: A Splunk instance that is remotely configured by a deployment server.
Server class: A group of deployment clients that facilitate the management of a set of deployment clients as a single unit.
Deployment app: A unit of content deployed by the deployment server to a group of deployment clients. Deployment apps can be fully developed apps, such as those available in Splunkbase, or they can be a simple group of configurations.
Distributed search: A deployment topology that portions search management and search fulfillment/indexing activities across multiple Splunk instances.
Things to do
Plan your deployment. Plan a deployment to make sure that the OS and Splunk software versions on your deployment server and client are compatible. Also make sure the deployment server is on a dedicated Splunk Enterprise instance that is not serving as an indexer or a search head.
Manage the deployment server. Manage the deployment server to provision deployment server resources and estimate how long it will take to download your apps to a set of clients.
Set up a client. Configure deployment clients to receive data from the deployment server. Use the forwarder management interface to manage the update process across all Splunk instances.