Deployment Architecture

How to split Cluster Master/Deployment server into two separate servers?

Contributor

Hi - I am migrating Splunk to a new hardware and looking for a way to split the combo cluster master/deployment server into two separate servers as recommended. Can anyone advise me which files need to go to which instance? It's also very helpful with CLIs showing how to deploy indexes to indexers and TA/apps to forwarders.

Thank you,

0 Karma
1 Solution

SplunkTrust
SplunkTrust

It's not necessary to have separate Cluster Master and Deployment Server instances. The two can run well together in smaller installations.

If you still want separate servers, clone the current server to the new hardware. Update IP addresses and host names in the config files as required.

On the new Cluster Master, delete the contents of $SPLUNK_HOME/etc/deployment-apps

On the new Deployment Server, delete the contents of $SPLUNK_HOME/etc/master-apps

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Contributor

I'm taking your advice and remain with the combo as it's working without any issues. There is a VM that I can use to split in two in case. Thank you again.

0 Karma

SplunkTrust
SplunkTrust

It's not necessary to have separate Cluster Master and Deployment Server instances. The two can run well together in smaller installations.

If you still want separate servers, clone the current server to the new hardware. Update IP addresses and host names in the config files as required.

On the new Cluster Master, delete the contents of $SPLUNK_HOME/etc/deployment-apps

On the new Deployment Server, delete the contents of $SPLUNK_HOME/etc/master-apps

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Contributor

Thank you richgalloway. The data feed is about $500 GB/day with 25 indexes. Don't you think I should split the roles in two or stay with one server with double roles? Thanks.

0 Karma

SplunkTrust
SplunkTrust

It really depends on how many buckets are being tracked by the CM and how many forwarders are supported by the DS. If your current combined server is handling the load then there is no need to split it unless you expect growth that would call for separate servers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!