I am having a cluster setup with the following architecture.
1) One Splunk Manager.
2) One Search Head
3) Two Peer nodes (i.e Two Indexers)
4) Total 50 Linux and Windows Forwarder servers.
I am trying to setup a deployment server in one of the indexer nodes. Could someone please let us know, whether we can use one of indexer node as deployment server or we need to have a dedicated server.
My requirement is to maintain all of the forwarders inputs.conf and outputs.conf from the deployment server.
I have gone through below URLS. Could some one suggest and provide me the actual steps for configuring deployment server and also configuration steps need to be performed at forwarders end.
Yes, you can use an indexer, but you a little over the recommended limit. You will have to review your server hardware and workload to see if it can support the extra work. If you find that after you configure the deployment server that it should be on it's own server, then the configuration can be relocated to a new server.
You can manage the inputs.conf and outputs.conf, but you will need at least two apps, one for windows and one for unix. If all of your windows and unix configs are not exactly the same, then you will need additional serverclasses for them.
Take the time to read and understand the material. A deployment server is very handy, but it must be configured correctly and each configuration is specific to the deployment - there is no magic plan that works for everyone.