Deployment Architecture

Deployment server strategies

Communicator

I have about 800 forwarders, 3 indexers and a search head.The indexers are in Asia,Europe and Americas. I would like to have a Deployment server to deploy several standard forwarders and also have consistent configuration files across all 3 indexers. I am thinking of having a single dedicated Deployment server and have various sever classes. Indexer class- For having similiar configuration and Apps, Windows_Forwarder class for windows forwarders and Linux_Forwarder class for the Linux forwarders.

Is a single deployment server enough or do I have to go for multiple Deployment servers? Can I use Single Deployment server to manage Forwarders and the 3 indexers?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

A single Deployment Server will be fine. I would set my deployment client phone home interval to about 10 minutes (600 seconds), which means you'll only be getting one or two requests per second in total from all clients on your DS. If you like, you can have the indexers check in a little more frequently.

View solution in original post

Splunk Employee
Splunk Employee

A single Deployment Server will be fine. I would set my deployment client phone home interval to about 10 minutes (600 seconds), which means you'll only be getting one or two requests per second in total from all clients on your DS. If you like, you can have the indexers check in a little more frequently.

View solution in original post

Contributor

gfriedmann
Any app dir should work (taking into account precedence). Just to be clear, you set the value in "seconds" and not "minutes," correct?

0 Karma

Communicator

I am having trouble getting this setting to implement. Using a universal forwarder on windows the default checkin seems to be 60 seconds. I tried to specify 5 minutes in /apps/foo/local/deploymentclient.conf , but it still checks in every 60 seconds.

Do you know if this must be set in system/local/deploymentclient.conf , or is it expected to work if specified in any /etc/app/ directory?

0 Karma

Contributor

Any config file under system/local/configfile.conf will take precedence over etc/apps/appX/configfile.conf. You mentioned windows agent. If you specify target url for deployment server when installing UF client via GUI manually or through silent installation (parameters) this config will always end up in system/local. So if you want to updated this with deployment server which will deploy any app to etc/app/appX it will NOT work. You need to get rid of system/local configuration.

Usually this is done this way:
1. install deploymentclient.conf via special configuration app from DS into etc/app/deploymentclient.conf.
2. install similar app that will run a script that will DELETE corresponding etc/system/deploymentclient.conf with restarting UF checked in DS.

0 Karma

Communicator

Thanks a lot kanapathy.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!