Deployment Architecture

A couple of questions about clustering

responsys_cm
Builder

We just purchased four new 16 core servers for a new Splunk cluster. Our old server is 8 core. Is it possible to use my old server as the cluster master?

I know the cluster master can't index external data, but can it act as a forwarder? There is a convoluted input on that machine that would be a pain to migrate. Can a cluster master act as a light forwarder?

Can you run the cluster master on the same box as the deployment server?

Thanks.

Craig

Tags (2)
0 Karma
1 Solution

Genti
Splunk Employee
Splunk Employee

Is it possible to use my old server as the cluster master?

Yes! As long as the old server does not continue to be used for indexing...

Can a cluster master act as a light forwarder?

I wouldnt do that, i would instead install a second instance of Splunk on the same box, (different ports for splunkd/splunkweb) then use Splunk LightweightForwarder (or better yet, just splunk universal forwarder. this will depend on if you need python or not.)

Can you run the cluster master on the same box as the deployment server?

Yes! There shouldn't be an issue with running DS and CM on the same Splunk instance.

View solution in original post

Genti
Splunk Employee
Splunk Employee

Is it possible to use my old server as the cluster master?

Yes! As long as the old server does not continue to be used for indexing...

Can a cluster master act as a light forwarder?

I wouldnt do that, i would instead install a second instance of Splunk on the same box, (different ports for splunkd/splunkweb) then use Splunk LightweightForwarder (or better yet, just splunk universal forwarder. this will depend on if you need python or not.)

Can you run the cluster master on the same box as the deployment server?

Yes! There shouldn't be an issue with running DS and CM on the same Splunk instance.

Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...