How do you handle deployments in search head clustering if you are no longer able to use a deployment server?

[mookiie2005]

We read that once you enable search head clustering in splunk 6.2 you are no longer able to use a deployment server. Has anyone adopted search head clustering? and if so how do you handle deployments?

[Steve_G_ · Accepted solution]

You can still use the deployment server to update indexers and forwarders. You just cannot use it for the search heads in the cluster.

To deploy updates to the clustered search heads, you must instead use a deployer. The deployer is specialized functionality available on any 6.2 Splunk Enterprise instance, and its sole purpose is to update search head cluster members. You can run the deployer on the same instance as the deployment server, but its functionality is entirely different.

For details, see http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/PropagateSHCconfigurationchanges

Also, see: http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/SHCsystemrequirements#Deployer_requirem...

[mookiie2005]

@ Steve G, thank you so much for the response. We have a large number of forwarders at several different data centers, and I just did not see how we could mange updating them without the deployment server functionality. This makes SHC a lot more appealing to us. Tank you for clearing up my misconception!