Is it possible to run Cluster Master and Deployment Server in the same instance?

[djcmay]

Hi,

I already found some questions to this, but none of them was a solution to my problem.

Can I run the Cluster Master and the Deployment Server on the same instance?

The Cluster Master will push the configuration to the peers and the Deployment Server send the configuration to all the forwarders. Will they impede each other or is this a possible way to go?

Best
Christoph

[Brian_Vetter]

As of 2018 the Managing Indexers and Clusters of Indexers : Additional roles for the master node now definitively says No

quote:

Additional roles for the master node
&nbsp

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions . . .
. . . snip . . .
&nbsp
!!! Caution: Do not colocate a deployment server on the master under any circumstances.

[matthieu_araman]

It's possible to have both on the same instance but it's context dependant.

As mentioned above, if your deployment server has a lot of clients or you have many indexers for the cluster master, this will increase load on the server, which may be a pb. In this case, be prepared to have to move one component to a dedicated instance.

[ChrisG · Accepted solution]

Strictly speaking, I don't think they will impede each other, and I guess it depends on the scale of your deployment. But looking at the documentation, it does not seem to be a recommended practice.

Quoting from the Updating Splunk Enterprise Instances manual:

---

For most deployments, the deployment server must run on a dedicated Splunk Enterprise instance that is not serving as an indexer or a search head. The exception is if the deployment server has only a small number of clients, 50 or less. Under those limited circumstances, it is possible for an indexer or search head to double as a deployment server.

Similarity, do not host a distributed management console, which is essentially a search head, on a deployment server with more than 50 clients.

You can, however, usually run a search head cluster deployer on the same instance as the deployment server.

---

And quoting from the Managing Indexers and Clusters of Indexers manual:

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions:

• You can use the master's built-in search head for debugging purposes.
• You might be able to run a search head cluster deployer on the master, depending on the master's load.
• You might be able to run a distributed management console on the master instance, depending on the master's load.

To run a deployer or a distributed management console on the master, the master's cluster should stay below the following limits:

• 30 indexers
• 100,000 buckets
• 10 indexes
• 10 search heads

[djcmay]

Thanks' alot. This will help.