Deployment Architecture

Multiple Deployment Server, VIP Load Balancer and NO CLIENTS

cachexploit
Explorer

We setup 3 deployment servers behind a LB VIP.  We set the VIP in deploymentclient.conf but for those agents we are not seeing them check in.  We logged in locally to both a *nix and a Win machine and we can telnet to the VIP on port 8089.  The LBer shows that traffic is being distributed between all three. Also, only our original DeploymentServer is showing clients, #2 and #3 do not show any clients at all.  All serverclass.conf match and we have serverChecksum set to true in global.  All of the app files are identical.

 

0 Karma
1 Solution

cachexploit
Explorer

So just as an update, we were able to get this to work through an F5 Loadbalancer and VIP.  You have to make sure that there are no http profiles assigned to the VIP rule on the F5.  Once we were able to do that, we can see that the Handshakes are being completed successfully and we see all the clients checking in throughout the day to all 3 deployment servers.

View solution in original post

0 Karma

cachexploit
Explorer

So just as an update, we were able to get this to work through an F5 Loadbalancer and VIP.  You have to make sure that there are no http profiles assigned to the VIP rule on the F5.  Once we were able to do that, we can see that the Handshakes are being completed successfully and we see all the clients checking in throughout the day to all 3 deployment servers.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

This is new to me also, but after short googling sessio it seems to be working solution. 

How about LB’s sticky session setting. Is it on or off? Probably better if nodes call at lest some time to the same backend instead of changing it on every  request to different backend node even in same transaction.

r. Ismo

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @cachexploit,

who approved this architecture?

for my knoledge, but I could be wrong, it isn't possible to have more DSs behind a LB!

you could have more DSs that manage different clients each one but not using a LB.

If you need more DSs because you have to manage too many clients for only one, you can use more resources (CPUs and RAMs) or more DSs but, as I said, each one has to manage a different list of clients.

In my experience, one DS with normal resources (12 CPUs and 12 GB RAM) managed more than 2000 clients.

Ciao.

Giuseppe

0 Karma

cachexploit
Explorer

Splunk has confirmed themselves that this should work along with multiple posts in this community about the same architecture.  I have a plan to roll out an abundance of UFs across our enterprise and was recommended this solution.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @cachexploit,

forget it, it's really new for me!

Ciao.

Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...