Deployment Architecture

Deployment server

Path Finder

Hi,

We are planning to migrate our Splunk environment to new servers and in the same process upgrade from version 5.01 to the latest version (6.01). We are currently using deployment server to distribute configuration to splunk universal forwarders. My question is: can a deployment server receive it's configuration from another deployment server? That is, can a deployment server act as both a deployment client and a deployment server? We currently have aprox 150 Splunk universal forwarders. We are planning to use intermediate forwarders between the splunk universal forwarder and the index servers.

Best regards,
Anne

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Short answer: Yes.

Long answer: I wouldn't, but it is possible. It's all a matter of whitelists and app assignments. I'm curious - why the intermediate forwarders? Splunk works best with direct connections to the indexers. I have 2 intermediate heavy forwarders - they are used for syslog processing as well as some JMX and ActiveQueue stuff - not traffic control.

Come to IRC! Meet us in #splunk on EFNet!

SplunkTrust
SplunkTrust

If this answered your questions, please mark it accepted. Thanks!

0 Karma

SplunkTrust
SplunkTrust

Not sure if you need that for your environment - although I do recommend the syslog-ng approach with a Heavy forwarder. It could be best for you, I'd have to know more :D. If your question has been answered, please accept it. Thanks!

0 Karma

Path Finder

Thanks 🙂 We found a recommendation to use intermediate forwarders in this document: http://www.aplura.com/docs/Splunk_Best_Practices.pdf.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!