Deployment Architecture

Deployment Server License Calculation: Will my architecture requires Heavy Forwarder?

Atchyuth_P
Path Finder

Hi Team,

In my environment we made the Deployment Server as License Master as well. Current Architecture

1 - Search Head

1 - Indexer 

1 - Deployment Server

2 - Universal Forwarders

I am planning to implement Master as well for the current architecture. Will my architecture requires Heavy Forwarder?

Addition to the above, If I am implementing HF is there an impact and also like to understand how the deployment pipeline works

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Atchyuth_P,

as @woodcock said, in general there's no requirement to use an HF in your architecture.

Usually HFs are used as concentrators when you want to reduce the open routes between a segregated network and an external Splunk or when you have to pull logs from Cloud Service Providers.

About the License Master, I usually don't install it on the Deployment Server because, if it has to manage more than 50 clients, it must be on a dedicated Server.

I usually put the License Master on the Master Node or on the Monitoring Console, in your case I'd put it on the Indexer.

Ciao.

Giuseppe

0 Karma

woodcock
Esteemed Legend

There is no reason to add UF until you know that you need to.

0 Karma

Atchyuth_P
Path Finder

Hi @woodcock 

Agree. We have data  sources(database server) which needs to be parsed for that reason need HF I am planning to introduce a intermediate forwarder in between. Just want to know will it cause an impact.

Pls have a look into my first question.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...