Deployment Architecture

Deployment server and cluster master on same machine from Splunk 7 to Splunk 8

realsplunk
Motivator

Hello,

our architecture in production was created years ago, we have Deployment Server and Cluster Master on same machine (linux vm) running Splunk Enterprise 7.3.4 fine.

Is there any specific risk keeping this architecture if we migrate to Splunk 8?

Thanks for your help.

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @realsplunk,

you surely know that it isn't a best practice to have Deployment Server and Master Node on the same server.

Deployment Server must be on a dedicated server when it has to manage more than 50 clients and Master Node has to be on a dedicated server always!

Probably you haven't many users, data and searches otherwise you should have low performances in searches and indexing.

Anyway, about your question, you have only to follow the indications to upgrade an Indexers' Cluster that you can find at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Upgradeacluster

In few words: before Master Node, then Search Heads and then Search Peers, eventually with a rolling  restart.

Ciao.

Giuseppe

View solution in original post

gl_splunkuser
Path Finder

Hello, 

As I understand the upgrade process has the following order:

1. Verify the compatibility of your apps with the new version.

2. Upgrade de master node.

3. Upgrade the SH cluster and the Deployer.

https://docs.splunk.com/Documentation/Splunk/8.0.7/DistSearch/UpgradeaSHC

4. Upgrade the peers of the indexer.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Upgradeacluster

 

Regards

0 Karma

realsplunk
Motivator

About 250 gb daily ingestion, 20 users daily, 3 indexers and 3 search heads (only 2 for users) the VM has 8 cpu/8 gb RAM however sometimes we have latencies with huge queries.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @realsplunk,

the numbers you said confirm that you should review your architecture!

Also the hardware reference is not adequate to the Splunk indications (at least 12 CPUs and 12 GB RAM): if you run the health check of Monitor Console, you surely have a warning for this.

You should try to analyze your loads using the Monitor Console and see how your infrastrure works.

In addition, if you have a problem, this is the first answer from Splunk Support.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @realsplunk,

you surely know that it isn't a best practice to have Deployment Server and Master Node on the same server.

Deployment Server must be on a dedicated server when it has to manage more than 50 clients and Master Node has to be on a dedicated server always!

Probably you haven't many users, data and searches otherwise you should have low performances in searches and indexing.

Anyway, about your question, you have only to follow the indications to upgrade an Indexers' Cluster that you can find at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Upgradeacluster

In few words: before Master Node, then Search Heads and then Search Peers, eventually with a rolling  restart.

Ciao.

Giuseppe

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.