Deployment Architecture

Deployment Server License Calculation: Will my architecture requires Heavy Forwarder?

Atchyuth_P
Path Finder

Hi Team,

In my environment we made the Deployment Server as License Master as well. Current Architecture

1 - Search Head

1 - Indexer 

1 - Deployment Server

2 - Universal Forwarders

I am planning to implement Master as well for the current architecture. Will my architecture requires Heavy Forwarder?

Addition to the above, If I am implementing HF is there an impact and also like to understand how the deployment pipeline works

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Atchyuth_P,

as @woodcock said, in general there's no requirement to use an HF in your architecture.

Usually HFs are used as concentrators when you want to reduce the open routes between a segregated network and an external Splunk or when you have to pull logs from Cloud Service Providers.

About the License Master, I usually don't install it on the Deployment Server because, if it has to manage more than 50 clients, it must be on a dedicated Server.

I usually put the License Master on the Master Node or on the Monitoring Console, in your case I'd put it on the Indexer.

Ciao.

Giuseppe

0 Karma

woodcock
Esteemed Legend

There is no reason to add UF until you know that you need to.

0 Karma

Atchyuth_P
Path Finder

Hi @woodcock 

Agree. We have data  sources(database server) which needs to be parsed for that reason need HF I am planning to introduce a intermediate forwarder in between. Just want to know will it cause an impact.

Pls have a look into my first question.

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...