To optimize, and effectively reduce administration overhead, you can use a forwarder instance as a deployment server (DS) to deploy apps in your local network.
Splunk Cloud does not provide a deployment server. However, you can use forwarders to mimic this DS behavior in your Splunk Cloud environment and use it to distribute apps from your Splunk Cloud stack and deployment client.
Read about the types of forwarders to get an overview of how forwarders work and see a comparison of their features and capabilities. Today we’ll outline a configuration using a heavy forwarder and a universal forwarder that you can scale based on your needs. The configuration is based on Splunk’s Professional Services Base Configurations toolset.
A deployment server is a great way to distribute apps on your network. Unfortunately, you cannot use a deployment server to manage index clusters or search head clusters, or upgrade installations of Splunk. You can use a dedicated heavy forwarder instance as a deployment server by placing it on the network with open firewalls for the Splunk Management Port to the DS host or you can deploy multiple DSs.
A DS can filter based on hostname, IP address, or machine type. So, we have a few options for deploying to all our clients.
Avoid using automation such as Puppet, Chef, or Ansible in conjunction with DS because it can cause .configs to disappear and break. Do not test your serverclasses.conf because it changes in a DEV environment.
Some of the following are to Splunk Enterprise manuals. However, they are applicable to Splunk Cloud when following the general procedure in the Things to know section:
I appreciate the wave of best practices answers that you have been posting recently.
When we were setting up our Splunk Cloud deployment the amount of documentation that was available regarding an intermediate forwarding tier consisting of Universal Forwarders was a bit lacking. Would it be possible to pull together best practices for that use case?
Thanks @djl - That's a topic in our backlog. I'll make a note of your interest if that helps increase it's priority for us. Thanks for being a follower!