Deployment Architecture

Can I use a deployment server to scale my Splunk Enterprise deployment?

adukes_splunk
Splunk Employee
Splunk Employee

Where can I find more information about using a deployment server and configuration files to manage my Splunk Enterprise deployment?

0 Karma
1 Solution

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team provided this response. Read more about How Crowdsourcing is Shaping the Future of Splunk Best Practices.

Scale easily with deployment servers and config files

To support larger environments, where data originates on many machines and where many users need to search the data, you can scale your deployment by installing Splunk across different machines. When you do this, you configure the Splunk instances so that each one performs a specialized task. For example, one or more instances might index the data, while another manages searches across the data. This is known as a distributed deployment.

Splunk provides a deployment server and configuration files to help you manage a distributed deployment and keep the configurations coordinated.

How a deployment server and config files help you scale efficiently

A deployment server gives you a single interface to manage configuration files, apps, and content updates to most Splunk Enterprise components: forwarders, non-clustered indexers, and search heads in a Splunk distributed deployment.

Things to know

A deployment server is a smart solution to manage a Splunk distributed deployment. Unfortunately, you cannot use a deployment server to manage clustered indexers or search head clusters, or upgrade installations of Splunk. But fear not, we'll come back to these topics in a future email.

When you plan a deployment that includes a deployment server, you will configure deployment clients, create deployment apps, and create server classes on the deployment server. Here are the terms you need to know:

  • Deployment: A set of distributed Splunk instances, working together.
  • Deployment server: A Splunk instance that acts as a centralized configuration manager, grouping together and collectively managing any number of Splunk instances.
  • Deployment client: A Splunk instance that is remotely configured by a deployment server.
  • Server class: A group of deployment clients that facilitate the management of a set of deployment clients as a single unit.
  • Deployment app: A unit of content deployed by the deployment server to a group of deployment clients. Deployment apps can be fully developed apps, such as those available in Splunkbase, or they can be a simple group of configurations.
  • Distributed search: A deployment topology that portions search management and search fulfillment/indexing activities across multiple Splunk instances.

Things to do

  • Plan your deployment. Plan a deployment to make sure that the OS and Splunk software versions on your deployment server and client are compatible. Also make sure the deployment server is on a dedicated Splunk Enterprise instance that is not serving as an indexer or a search head.
  • Manage the deployment server. Manage the deployment server to provision deployment server resources and estimate how long it will take to download your apps to a set of clients.
  • Set up a client. Configure deployment clients to receive data from the deployment server. Use the forwarder management interface to manage the update process across all Splunk instances.
  • Deploy an app to your clients.nCreate a server class to map a group of deployment clients to one or more deployment apps to update the distribute configuration.

View solution in original post

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team provided this response. Read more about How Crowdsourcing is Shaping the Future of Splunk Best Practices.

Scale easily with deployment servers and config files

To support larger environments, where data originates on many machines and where many users need to search the data, you can scale your deployment by installing Splunk across different machines. When you do this, you configure the Splunk instances so that each one performs a specialized task. For example, one or more instances might index the data, while another manages searches across the data. This is known as a distributed deployment.

Splunk provides a deployment server and configuration files to help you manage a distributed deployment and keep the configurations coordinated.

How a deployment server and config files help you scale efficiently

A deployment server gives you a single interface to manage configuration files, apps, and content updates to most Splunk Enterprise components: forwarders, non-clustered indexers, and search heads in a Splunk distributed deployment.

Things to know

A deployment server is a smart solution to manage a Splunk distributed deployment. Unfortunately, you cannot use a deployment server to manage clustered indexers or search head clusters, or upgrade installations of Splunk. But fear not, we'll come back to these topics in a future email.

When you plan a deployment that includes a deployment server, you will configure deployment clients, create deployment apps, and create server classes on the deployment server. Here are the terms you need to know:

  • Deployment: A set of distributed Splunk instances, working together.
  • Deployment server: A Splunk instance that acts as a centralized configuration manager, grouping together and collectively managing any number of Splunk instances.
  • Deployment client: A Splunk instance that is remotely configured by a deployment server.
  • Server class: A group of deployment clients that facilitate the management of a set of deployment clients as a single unit.
  • Deployment app: A unit of content deployed by the deployment server to a group of deployment clients. Deployment apps can be fully developed apps, such as those available in Splunkbase, or they can be a simple group of configurations.
  • Distributed search: A deployment topology that portions search management and search fulfillment/indexing activities across multiple Splunk instances.

Things to do

  • Plan your deployment. Plan a deployment to make sure that the OS and Splunk software versions on your deployment server and client are compatible. Also make sure the deployment server is on a dedicated Splunk Enterprise instance that is not serving as an indexer or a search head.
  • Manage the deployment server. Manage the deployment server to provision deployment server resources and estimate how long it will take to download your apps to a set of clients.
  • Set up a client. Configure deployment clients to receive data from the deployment server. Use the forwarder management interface to manage the update process across all Splunk instances.
  • Deploy an app to your clients.nCreate a server class to map a group of deployment clients to one or more deployment apps to update the distribute configuration.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...