Deployment Architecture

One client Server needs access to two separate Deployment Servers - Is it possible?

MasterOogway
Communicator

I have multiple Splunk environments, A & B, and a client that needs to send App data to A and syslog to B. But I want/need to have two Deployment Servers managing each environments data separately. Is it possible to have a separate Deployment server configured to manage the App logs, while the second Deployment Server manages the Syslog & HW logs?

There are specific rules based around a FireWall keeping me from managing the Syslog from outside the Client installation location. But outside the Firewall is where I would like to manage the App logs. Thus the question, can a single Client server leverage two separate Deployment servers to manage the data?

I currently have one Deployment Server in place, but would like to manage two for consistency.
Thoughts?

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

I am afraid, that this is not possible.
the deployment-client can have only 1 deployment-server at a time.
And you change from one to another, the new one will redeploy all his applications, keeping the existing, and replacing the ones with the same app name.

A possible workaround is to cascade the deployment servers, ( A deploy to B, that deploy to clients. To do that, play with targetRepositoryLocation and RepositoryLocation. ). But it means that all the serverclass.conf and apps will be identical on each deployment-server.

Finally the best solution is probably to install 2 forwarders on the server, and have each of them controlled by a different deployment-server (with specific inputs and outputs).

View solution in original post

MasterOogway
Communicator

Yeah....that is what I thought, but wanted to get confirmation from another source.
Without making a "one-off" solution of a dual installation, I will have to suffer with managing this set of hosts
from an alternate DeploymentServer than that of the other Windows/UNIX servers.

0 Karma

yannK
Splunk Employee
Splunk Employee

I am afraid, that this is not possible.
the deployment-client can have only 1 deployment-server at a time.
And you change from one to another, the new one will redeploy all his applications, keeping the existing, and replacing the ones with the same app name.

A possible workaround is to cascade the deployment servers, ( A deploy to B, that deploy to clients. To do that, play with targetRepositoryLocation and RepositoryLocation. ). But it means that all the serverclass.conf and apps will be identical on each deployment-server.

Finally the best solution is probably to install 2 forwarders on the server, and have each of them controlled by a different deployment-server (with specific inputs and outputs).

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...