Deployment Architecture

Can Search head members and deployer run on same lb

dhawal_sanghvi
New Member

Can the deployer and search head cluster members run on the same load balancer? I have a load balancer and the pool members behind the lb are search head members, captain. Can I have the deployer on the same load balancer or should I run independently outside lb?

Tags (1)
0 Karma
1 Solution

koshyk
Super Champion

Bit tricky, but my answer is it depends on your environment and risk factors

  1. Deployer is mainly for Splunk administrators but SH members for end-users. So the main query to ask yourself is why you need a load-balancer for Deployer?
  2. If you have so many Deployers (eg to manage multiple SH clusters), then better to configure a LB just for deployers
  3. In some of our client environments, the administrator systems are in different security context and accessible only for administrators similar to Cluster Master and deployment-server, but SH members are exposed to more employees like Customer Support. So better to have segregation so no one meddles with your admin systems

Using all the above analogy , my suggestion is to have SH-members in LB and Deployer to run separately.

View solution in original post

0 Karma

dhawal_sanghvi
New Member

Thanks for all the inputs. I will have the deployer out of the LB as a stand alone Splunk server.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dhawal_sanghvi,
why you need to put your Deployer on Load Balancer?
Deployer is a single server (so it doesn't need LB) dedicated to manage Search Head Cluster and usually isn't accessed by users, but only by administrators.
Bye.
Giuseppe

0 Karma

koshyk
Super Champion

Bit tricky, but my answer is it depends on your environment and risk factors

  1. Deployer is mainly for Splunk administrators but SH members for end-users. So the main query to ask yourself is why you need a load-balancer for Deployer?
  2. If you have so many Deployers (eg to manage multiple SH clusters), then better to configure a LB just for deployers
  3. In some of our client environments, the administrator systems are in different security context and accessible only for administrators similar to Cluster Master and deployment-server, but SH members are exposed to more employees like Customer Support. So better to have segregation so no one meddles with your admin systems

Using all the above analogy , my suggestion is to have SH-members in LB and Deployer to run separately.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...