Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: How to split Cluster Master/Deployment server ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi - I am migrating Splunk to a new hardware and looking for a way to split the combo cluster master/deployment server into two separate servers as recommended. Can anyone advise me which files need to go to which instance? It's also very helpful with CLIs showing how to deploy indexes to indexers and TA/apps to forwarders.
Thank you,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's not necessary to have separate Cluster Master and Deployment Server instances. The two can run well together in smaller installations.
If you still want separate servers, clone the current server to the new hardware. Update IP addresses and host names in the config files as required.
On the new Cluster Master, delete the contents of $SPLUNK_HOME/etc/deployment-apps
On the new Deployment Server, delete the contents of $SPLUNK_HOME/etc/master-apps
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm taking your advice and remain with the combo as it's working without any issues. There is a VM that I can use to split in two in case. Thank you again.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's not necessary to have separate Cluster Master and Deployment Server instances. The two can run well together in smaller installations.
If you still want separate servers, clone the current server to the new hardware. Update IP addresses and host names in the config files as required.
On the new Cluster Master, delete the contents of $SPLUNK_HOME/etc/deployment-apps
On the new Deployment Server, delete the contents of $SPLUNK_HOME/etc/master-apps
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you richgalloway. The data feed is about $500 GB/day with 25 indexes. Don't you think I should split the roles in two or stay with one server with double roles? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It really depends on how many buckets are being tracked by the CM and how many forwarders are supported by the DS. If your current combined server is handling the load then there is no need to split it unless you expect growth that would call for separate servers.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Rich,
it's our case and seeing no major problem with same VM for DS/CM with Splunk Enterprise 7.3.4, 900+ UF, 3 indexers, ~250 gb/day.
However in the docs : https://docs.splunk.com/Documentation/Splunk/8.1.2/Updating/Planadeployment#Deployment_server_and_ot...
A cluster manager node and a deployment server both consume significant system resources while performing their tasks. The manager node needs reliable and continuous access to resources to perform the ongoing management of the cluster, and the deployment server can easily overwhelm those resources while deploying updates to its deployment clients.
Do you think no problem when we'll upgrade to Splunk 8.1?
Thanks.
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
