How to setup/enable Splunk Heavy Forwarder as Deployment server

[arunkumarv26]

In our environment, we have 3 regions having 3 different heavy forwarders to report to Splunk Cloud instance.

We are planning to enable Deployment Server in one of the heavy forwarder (having high-end hardware configurations) to manage the APPS, Configurations of all the UF in all 3 regions.

Please let me know if it is recommended solution or not. If yes, is there any challenges with respect to performance.

[woodcock · Accepted solution]

A Splunk Deployment Server experiences very high port I/O usage and most servers are overwhelmed around the time they are serving 1000s of clients. If you never expect to serve more than 50 Deployment Clients, then you could get away with this but I highly advise against co-locating any other service on your Deployment Server. The general rule-of-thumb is 1000 Deployment Clients per 1-minute of phonehome (the default is 10-minutes for phonehome so that means 10K Delpoyment Clients), but this is with a dedicated Deployment Server with no other shared responsibilities/roles.

[harsmarvania57]

Hi @arunkumarv26,

I'll suggest to run deployment server on separate machine because Deployment server requires high CPU and memory usage while downloading apps on UF (ref. : http://docs.splunk.com/Documentation/Splunk/6.6.1/Updating/Calculatedeploymentserverperformance ) & Heavy forwarder is already doing parsing of data so HF is also using resources on same server.

Thanks,
Harshil