Deployment Architecture

Is it possible to run Cluster Master and Deployment Server in the same instance?

djcmay
Explorer

Hi,

I already found some questions to this, but none of them was a solution to my problem.

Can I run the Cluster Master and the Deployment Server on the same instance?

The Cluster Master will push the configuration to the peers and the Deployment Server send the configuration to all the forwarders. Will they impede each other or is this a possible way to go?

Best
Christoph

0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

Strictly speaking, I don't think they will impede each other, and I guess it depends on the scale of your deployment. But looking at the documentation, it does not seem to be a recommended practice.

Quoting from the Updating Splunk Enterprise Instances manual:


For most deployments, the deployment server must run on a dedicated Splunk Enterprise instance that is not serving as an indexer or a search head. The exception is if the deployment server has only a small number of clients, 50 or less. Under those limited circumstances, it is possible for an indexer or search head to double as a deployment server.

Similarity, do not host a distributed management console, which is essentially a search head, on a deployment server with more than 50 clients.

You can, however, usually run a search head cluster deployer on the same instance as the deployment server.


And quoting from the Managing Indexers and Clusters of Indexers manual:

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions:

  • You can use the master's built-in search head for debugging purposes.
  • You might be able to run a search head cluster deployer on the master, depending on the master's load.
  • You might be able to run a distributed management console on the master instance, depending on the master's load.

To run a deployer or a distributed management console on the master, the master's cluster should stay below the following limits:

  • 30 indexers
  • 100,000 buckets
  • 10 indexes
  • 10 search heads

View solution in original post

Brian_Vetter
Engager

As of 2018 the Managing Indexers and Clusters of Indexers : Additional roles for the master node now definitively says No

quote:

Additional roles for the master node
&nbsp

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions . . .
. . . snip . . .
&nbsp
!!! Caution: Do not colocate a deployment server on the master under any circumstances.

matthieu_araman
Communicator

It's possible to have both on the same instance but it's context dependant.

As mentioned above, if your deployment server has a lot of clients or you have many indexers for the cluster master, this will increase load on the server, which may be a pb. In this case, be prepared to have to move one component to a dedicated instance.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Strictly speaking, I don't think they will impede each other, and I guess it depends on the scale of your deployment. But looking at the documentation, it does not seem to be a recommended practice.

Quoting from the Updating Splunk Enterprise Instances manual:


For most deployments, the deployment server must run on a dedicated Splunk Enterprise instance that is not serving as an indexer or a search head. The exception is if the deployment server has only a small number of clients, 50 or less. Under those limited circumstances, it is possible for an indexer or search head to double as a deployment server.

Similarity, do not host a distributed management console, which is essentially a search head, on a deployment server with more than 50 clients.

You can, however, usually run a search head cluster deployer on the same instance as the deployment server.


And quoting from the Managing Indexers and Clusters of Indexers manual:

As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions:

  • You can use the master's built-in search head for debugging purposes.
  • You might be able to run a search head cluster deployer on the master, depending on the master's load.
  • You might be able to run a distributed management console on the master instance, depending on the master's load.

To run a deployer or a distributed management console on the master, the master's cluster should stay below the following limits:

  • 30 indexers
  • 100,000 buckets
  • 10 indexes
  • 10 search heads

View solution in original post

djcmay
Explorer

Thanks' alot. This will help.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!