Centralized management

[dani9]

A way to implement centralized management from web-GUI on SH of main configuration like forwarder, data retention, etc ?

[gcusello]

Hi dani9,
you canno use only one centrilezed console to manage Splunk infrastructure, you have to use more servers:

• Forwarders are managed using Deployment Server that must stai on a dedicated server (if you have to manage more than 50 targets) and never an Indexer or a Search Head or the Master Node;
• Indexers' cluster are managed using the Masted Node that can stay on a shared server but if you have many logs to index Splunk hints to use a dedicated one (it's an Heavy role);
• Search Heads are managed by Deployer, that can stay on a shared server (it isn't an heavy role!);
• License Master can stay on a shared server (it isn't an heavy role!);
• Monitoring Console can stay on a shared server (it's an heavy role!).

So you have at least to use two or three servers for your monitoring consoles.

You can find these indications in Splunk docs in every section (Indexers Cluster, Search Heads Cluster, Deployment Server):
https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Systemrequirements#Additional_roles_for_t...
https://docs.splunk.com/Documentation/Splunk/8.0.0/DistSearch/SHCdeploymentoverview
https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Planadeployment#Deployment_server_and_ot...

Ciao.
Giuseppe

[richgalloway]

Forwarders are managed at Settings->Forwarder Management on your Deployment Server (DS).
Data retention is managed at Settings->Indexes in a standalone environment or in indexes.conf on the Master Node (MN).
Both DS and MN can be on the SH instance, but this is not best practice.