Deployment Architecture

Chronology of Splunk Deployment

sarwshai
Communicator

I need to build Splunk Distributed Environment, how should i configure the different components. I have License/Cluster Master, Indexers, search head and Deployment Server.

I am thinking of below chronology,

1. License/Cluster Master/Deployment Server
2. Indexers
3. search head
4. Heavy Forwarder

Is it right enough, or is there a better way? Also what precautions/prequisite should i keep in mind while deploying all these?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @sarwshai,
The order you defined it's correct, I'd change only Deployment Server:

  • it's correct to start from Master Node/License Master;
  • Search Peer should be configured immediately after MN (or in the same time);
  • Then Search Heads;
  • You can start with Deployment Server when you'll start with the periferals systems (Heavy and Universal Forwarders);
  • At this point you can start with the Heavy Forwarders;
  • ath the end you should start with Universal Forwarders.

Only some little hints:

  • forward the logs of all systems to the indexers,
  • configure a system as Monitoring Console and configure it: it should be better to use a dedicated server or, if you haven't an heavy load on the Master Node, you could use it, but not DS, Indexers and SHs.

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sarwshai,
The order you defined it's correct, I'd change only Deployment Server:

  • it's correct to start from Master Node/License Master;
  • Search Peer should be configured immediately after MN (or in the same time);
  • Then Search Heads;
  • You can start with Deployment Server when you'll start with the periferals systems (Heavy and Universal Forwarders);
  • At this point you can start with the Heavy Forwarders;
  • ath the end you should start with Universal Forwarders.

Only some little hints:

  • forward the logs of all systems to the indexers,
  • configure a system as Monitoring Console and configure it: it should be better to use a dedicated server or, if you haven't an heavy load on the Master Node, you could use it, but not DS, Indexers and SHs.

Ciao.
Giuseppe

sarwshai
Communicator

Thanks for the suggestion, one point to clarify. I am planning to configure DS on License/Cluster master itself due to hardware restrictions, will it work smoothly (because planning to keep all managment roles under one server)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sarwshai,
No: Deployment Server must be on a dedicated server when it manages more than 50 clients and anyway never can be shared with the Master Node.
You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Planadeployment#Deployment_server_and_ot... .

When you'll use a Search Head Cluster, you'll be able to configure Deployer on Master Node, but Deployment Server is an Heavy roale and cannot use shared hardware (when more than 50 clients to manage).

Ciao.
Giuseppe

sarwshai
Communicator

Thanks @gcusello for the info.

0 Karma

sarwshai
Communicator

@gcusello , still have one doubt, can i configure DS on Heavy Forwarder instead of License/Cluster master

0 Karma

gcusello
SplunkTrust
SplunkTrust

I don't like it! but if you cannot use a dedicated server (better!).
Ciao.
Giuseppe

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...