Deployment server

[annebeate]

Hi,

We are planning to migrate our Splunk environment to new servers and in the same process upgrade from version 5.01 to the latest version (6.01). We are currently using deployment server to distribute configuration to splunk universal forwarders. My question is: can a deployment server receive it's configuration from another deployment server? That is, can a deployment server act as both a deployment client and a deployment server? We currently have aprox 150 Splunk universal forwarders. We are planning to use intermediate forwarders between the splunk universal forwarder and the index servers.

Best regards,
Anne

[alacercogitatus]

Short answer: Yes.

Long answer: I wouldn't, but it is possible. It's all a matter of whitelists and app assignments. I'm curious - why the intermediate forwarders? Splunk works best with direct connections to the indexers. I have 2 intermediate heavy forwarders - they are used for syslog processing as well as some JMX and ActiveQueue stuff - not traffic control.

Come to IRC! Meet us in #splunk on EFNet!

[alacercogitatus]

If this answered your questions, please mark it accepted. Thanks!

[alacercogitatus]

Not sure if you need that for your environment - although I do recommend the syslog-ng approach with a Heavy forwarder. It could be best for you, I'd have to know more :D. If your question has been answered, please accept it. Thanks!

[annebeate]

Thanks 🙂 We found a recommendation to use intermediate forwarders in this document: http://www.aplura.com/docs/Splunk_Best_Practices.pdf.