Deployment server and cluster master on same machine from Splunk 7 to Splunk 8

[splunkreal]

Hello,

our architecture in production was created years ago, we have Deployment Server and Cluster Master on same machine (linux vm) running Splunk Enterprise 7.3.4 fine.

Is there any specific risk keeping this architecture if we migrate to Splunk 8?

Thanks for your help.

[gl_splunkuser]

Hello, 

As I understand the upgrade process has the following order:

1. Verify the compatibility of your apps with the new version.

2. Upgrade de master node.

3. Upgrade the SH cluster and the Deployer.

https://docs.splunk.com/Documentation/Splunk/8.0.7/DistSearch/UpgradeaSHC

4. Upgrade the peers of the indexer.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Upgradeacluster

Regards

[splunkreal]

About 250 gb daily ingestion, 20 users daily, 3 indexers and 3 search heads (only 2 for users) the VM has 8 cpu/8 gb RAM however sometimes we have latencies with huge queries.

[gcusello]

Hi @splunkreal,

the numbers you said confirm that you should review your architecture!

Also the hardware reference is not adequate to the Splunk indications (at least 12 CPUs and 12 GB RAM): if you run the health check of Monitor Console, you surely have a warning for this.

You should try to analyze your loads using the Monitor Console and see how your infrastrure works.

In addition, if you have a problem, this is the first answer from Splunk Support.

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @splunkreal,

you surely know that it isn't a best practice to have Deployment Server and Master Node on the same server.

Deployment Server must be on a dedicated server when it has to manage more than 50 clients and Master Node has to be on a dedicated server always!

Probably you haven't many users, data and searches otherwise you should have low performances in searches and indexing.

Anyway, about your question, you have only to follow the indications to upgrade an Indexers' Cluster that you can find at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Upgradeacluster

In few words: before Master Node, then Search Heads and then Search Peers, eventually with a rolling  restart.

Ciao.

Giuseppe