Deployment Architecture

How to configure a deployment server?

Federica_92
Communicator

Hello everyone,

I would like to set up a splunk deployment server, but I'm not sure where the file of configuration has to be stored: default or local?
I read the documentation about it, but I'm not sure that I have an understand how it is working.
All the configuration about my architecture can be stored in the deployment server folder? So all the index.conf, props.conf?

If my deployment server is separated by the indexer? So for example I have a big search head with the deployment server and 5 indexer separated, and this indexer are getting data from the forwarder, can I configure index and forwarder in the deployment server?
How can I do it?

Thank you so much!

esix_splunk
Splunk Employee
Splunk Employee

Have you seen this blog post? : http://blogs.splunk.com/2016/08/31/adding-a-deployment-server-forwarder-management-to-a-new-or-exist...

This covers creating a deployment server on premise, that deploys to Splunk Cloud. The principal is the same, just eliminate the Splunk Cloud App and substitute your own app. Deployment server requires a full instance of Splunk to run, so a HF, SH, LM, CM, or even IDX can work. However best practices is not to home this on a mission critical instance, as there could be resource issues. Most deployments will be a VM dedicated to the Deployment Server. That being said, housing it on a License Master (LM) or even Cluster Master (CM) node is viable, assuming your deployment is sized properly, and again, you are not resource quenched.

princemanto2580
Path Finder

Hi,

I have the same understanding issue.

  1. If I would like to make SH along with DS in the same instance what are the conf file need to create and where (default or local) and additionally which instance (like IDX and UF).

  2. Similarly, if there is standalone DS instance.

0 Karma

woodcock
Esteemed Legend

The thing that makes any Splunk server a DS is the presence of a serverclass.conf file, typically in $SPLUNK_HOME/etc/system/local/serverclass.conf. So on a fresh install or an existing Search Head, just create that file and restart Splunk and it is now a DS.

See my answer.

princemanto2580
Path Finder

Thanks for your responds with a crystal clear answer. As I am just a newcomer on this platform, it really help me to build the concept.

Similarly, on each IDX, UF and HF instance under $SPLUNK_HOME/etc/system/local/, do I need to create deploymentclient.conf. This will not be applicable for SH, although if I have separate DS instance.

0 Karma

woodcock
Esteemed Legend

If you are using DS, never put anything in $SPLUNK_HOME/etc/system/local because then it cannot be controlled (overridden) from the DS. Instead create a DeploymentClient app and then manually deploy this to your Deployment Clients the first time. This way you can hand individual clients (or classes of them) back and forth to different DS nodes (i.e. lab vs production) from each DS.

The only gotcha is that you should NOT deploy to clustered Indexers or clustered Search Heads.

woodcock
Esteemed Legend

You should create apps under $SPLUNK_HOME/etc/deployment-apps/VariousAppsHere/default/ on the server that is to act as DS. These apps should include:
- indexer (or similar) that has all of your indexer configuration files ( outputs.conf )
- someapp (or similar) for each different kind of input/sourcetype ( inputs.conf )
- deploymentclient (or similar) that contains deploymentclient.conf

See here, too:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Updating/Configuredeploymentclients
http://wiki.splunk.com/Deploy:DeploymentServer

ddrillic
Ultra Champion

And $SPLUNK_HOME/etc/system/local/serverclass.conf

Interesting thing @woodcock - I don't see any deploymentclient.conf on my deployment server but the deploymentclient.conf does exist on the forwarders. Where does it come from?

woodcock
Esteemed Legend

You have to create your own deploymentclient app that should include deploymentclient.conf in the default directory. The first time that you deploy a forwarder, you will have to put this app on your forwarder manually but after that, you can manage it from your DS.

ddrillic
Ultra Champion

Very interesting @woodcock.

0 Karma

woodcock
Esteemed Legend

As the creator (or distributor) of the app, you should put your stuff in the default folder.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...