Deployment Architecture

One client Server needs access to two separate Deployment Servers - Is it possible?

MasterOogway
Communicator

I have multiple Splunk environments, A & B, and a client that needs to send App data to A and syslog to B. But I want/need to have two Deployment Servers managing each environments data separately. Is it possible to have a separate Deployment server configured to manage the App logs, while the second Deployment Server manages the Syslog & HW logs?

There are specific rules based around a FireWall keeping me from managing the Syslog from outside the Client installation location. But outside the Firewall is where I would like to manage the App logs. Thus the question, can a single Client server leverage two separate Deployment servers to manage the data?

I currently have one Deployment Server in place, but would like to manage two for consistency.
Thoughts?

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

I am afraid, that this is not possible.
the deployment-client can have only 1 deployment-server at a time.
And you change from one to another, the new one will redeploy all his applications, keeping the existing, and replacing the ones with the same app name.

A possible workaround is to cascade the deployment servers, ( A deploy to B, that deploy to clients. To do that, play with targetRepositoryLocation and RepositoryLocation. ). But it means that all the serverclass.conf and apps will be identical on each deployment-server.

Finally the best solution is probably to install 2 forwarders on the server, and have each of them controlled by a different deployment-server (with specific inputs and outputs).

View solution in original post

MasterOogway
Communicator

Yeah....that is what I thought, but wanted to get confirmation from another source.
Without making a "one-off" solution of a dual installation, I will have to suffer with managing this set of hosts
from an alternate DeploymentServer than that of the other Windows/UNIX servers.

0 Karma

yannK
Splunk Employee
Splunk Employee

I am afraid, that this is not possible.
the deployment-client can have only 1 deployment-server at a time.
And you change from one to another, the new one will redeploy all his applications, keeping the existing, and replacing the ones with the same app name.

A possible workaround is to cascade the deployment servers, ( A deploy to B, that deploy to clients. To do that, play with targetRepositoryLocation and RepositoryLocation. ). But it means that all the serverclass.conf and apps will be identical on each deployment-server.

Finally the best solution is probably to install 2 forwarders on the server, and have each of them controlled by a different deployment-server (with specific inputs and outputs).

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...