How to split Cluster Master/Deployment server into two separate servers?

[vnguyen46]

Hi - I am migrating Splunk to a new hardware and looking for a way to split the combo cluster master/deployment server into two separate servers as recommended. Can anyone advise me which files need to go to which instance? It's also very helpful with CLIs showing how to deploy indexes to indexers and TA/apps to forwarders.

Thank you,

[vnguyen46]

I'm taking your advice and remain with the combo as it's working without any issues. There is a VM that I can use to split in two in case. Thank you again.

[richgalloway · Accepted solution]

It's not necessary to have separate Cluster Master and Deployment Server instances. The two can run well together in smaller installations.

If you still want separate servers, clone the current server to the new hardware. Update IP addresses and host names in the config files as required.

On the new Cluster Master, delete the contents of $SPLUNK_HOME/etc/deployment-apps

On the new Deployment Server, delete the contents of $SPLUNK_HOME/etc/master-apps

[vnguyen46]

Thank you richgalloway. The data feed is about $500 GB/day with 25 indexes. Don't you think I should split the roles in two or stay with one server with double roles? Thanks.

[richgalloway]

It really depends on how many buckets are being tracked by the CM and how many forwarders are supported by the DS. If your current combined server is handling the load then there is no need to split it unless you expect growth that would call for separate servers.

[splunkreal]

Hello Rich,

it's our case and seeing no major problem with same VM for DS/CM with Splunk Enterprise 7.3.4, 900+ UF, 3 indexers, ~250 gb/day.

However in the docs : https://docs.splunk.com/Documentation/Splunk/8.1.2/Updating/Planadeployment#Deployment_server_and_ot...

A cluster manager node and a deployment server both consume significant system resources while performing their tasks. The manager node needs reliable and continuous access to resources to perform the ongoing management of the cluster, and the deployment server can easily overwhelm those resources while deploying updates to its deployment clients.

Do you think no problem when we'll upgrade to Splunk 8.1?

Thanks.