Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Can a deployment server be clustered somehow?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can a deployment server be clustered somehow?
Hi,
Splunk 6.2 on Windows.
Can/should a deployment server be clustered somehow? I can't find any docs on this. I imagine shared data on NFS and servers behind a load balancer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Watch this video and pay special attention to "Hierarchical Deployments":
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could have a "main" DS that deploys only to subordinate DS nodes and have a cron job on each subordinate DS that runs every few minutes and synchronizes everything in $SPLUNK_HOME/etc/apps to $SPLUNK_HOME/etc/deployment-apps and then hand-manage (or use load-balancer/VIP) to have your forwarders spread out across each of your subordinate DS instances.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So if I do that, forwarder management is going to be hit or miss right? Effectively every subordinate DS is a standalone? The "main" DS has the server classes, but I won't see what clients are connected? I'm guessing the information about clients doesn't live in /etc?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should be able to get the client connection information from _internal on your Search Head.
The documentation talks about how DS performance can break down with relatively few clients/connections here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Calculatedeploymentserverperformance
Unfortunately it really doesn't tell how to mitigate other than to change PhoneHome settings.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
