Deployment Architecture

Centralized management


A way to implement centralized management from web-GUI on SH of main configuration like forwarder, data retention, etc ?

0 Karma

Esteemed Legend

Hi dani9,
you canno use only one centrilezed console to manage Splunk infrastructure, you have to use more servers:

  • Forwarders are managed using Deployment Server that must stai on a dedicated server (if you have to manage more than 50 targets) and never an Indexer or a Search Head or the Master Node;
  • Indexers' cluster are managed using the Masted Node that can stay on a shared server but if you have many logs to index Splunk hints to use a dedicated one (it's an Heavy role);
  • Search Heads are managed by Deployer, that can stay on a shared server (it isn't an heavy role!);
  • License Master can stay on a shared server (it isn't an heavy role!);
  • Monitoring Console can stay on a shared server (it's an heavy role!).

So you have at least to use two or three servers for your monitoring consoles.

You can find these indications in Splunk docs in every section (Indexers Cluster, Search Heads Cluster, Deployment Server):


0 Karma


Forwarders are managed at Settings->Forwarder Management on your Deployment Server (DS).
Data retention is managed at Settings->Indexes in a standalone environment or in indexes.conf on the Master Node (MN).
Both DS and MN can be on the SH instance, but this is not best practice.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...