Deployment Architecture

One client Server needs access to two separate Deployment Servers - Is it possible?

MasterOogway
Communicator

I have multiple Splunk environments, A & B, and a client that needs to send App data to A and syslog to B. But I want/need to have two Deployment Servers managing each environments data separately. Is it possible to have a separate Deployment server configured to manage the App logs, while the second Deployment Server manages the Syslog & HW logs?

There are specific rules based around a FireWall keeping me from managing the Syslog from outside the Client installation location. But outside the Firewall is where I would like to manage the App logs. Thus the question, can a single Client server leverage two separate Deployment servers to manage the data?

I currently have one Deployment Server in place, but would like to manage two for consistency.
Thoughts?

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

I am afraid, that this is not possible.
the deployment-client can have only 1 deployment-server at a time.
And you change from one to another, the new one will redeploy all his applications, keeping the existing, and replacing the ones with the same app name.

A possible workaround is to cascade the deployment servers, ( A deploy to B, that deploy to clients. To do that, play with targetRepositoryLocation and RepositoryLocation. ). But it means that all the serverclass.conf and apps will be identical on each deployment-server.

Finally the best solution is probably to install 2 forwarders on the server, and have each of them controlled by a different deployment-server (with specific inputs and outputs).

View solution in original post

MasterOogway
Communicator

Yeah....that is what I thought, but wanted to get confirmation from another source.
Without making a "one-off" solution of a dual installation, I will have to suffer with managing this set of hosts
from an alternate DeploymentServer than that of the other Windows/UNIX servers.

0 Karma

yannK
Splunk Employee
Splunk Employee

I am afraid, that this is not possible.
the deployment-client can have only 1 deployment-server at a time.
And you change from one to another, the new one will redeploy all his applications, keeping the existing, and replacing the ones with the same app name.

A possible workaround is to cascade the deployment servers, ( A deploy to B, that deploy to clients. To do that, play with targetRepositoryLocation and RepositoryLocation. ). But it means that all the serverclass.conf and apps will be identical on each deployment-server.

Finally the best solution is probably to install 2 forwarders on the server, and have each of them controlled by a different deployment-server (with specific inputs and outputs).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...