Hello Guys,
I have an existing deployment server and I'm reviewing the average network bandwidth of the server. That could help me before migrating the server into a new box. Any thoughts? Thanks!
I think I haven't put the correct question. So right now we have a deployment server will need to migrate it into Cloud. I think the possibly biggest concern for us is the network latency in Cloud from/to the target endpoints. Is there a search query that can help and check the network traffic actively flowing?
As @isoutamo already pointed out "migrate to Cloud" is a bit ambiguous term. As far as I remember if you're using Splunk Cloud, you still need to set up DS on your own (that's one of the uses for the 0-byte ingest license).
If you're simply migrating from on-prem installation to a cloud-based (GCP, AWS or any other provider really) Splunk Enterprise installation, you can put your DS there. A DS is not that sensitive to latency so it shouldn't matter that much.
There are other things to consider however - if your DS were to be exposed to the internet instead of connected to your network via VPN you will probably want to use deployment client authentication. You might also want to raise the phone home interval (which you normally probably should do anyway even with an on-prem setup) to lower load on DS and save on outgoing traffic (which you might be billed on in case of many cloud providers).
The amount of traffic will depend on the number of clients, phone home frequency, size of your apps and frequency of changes in apps.
You should be able to do some aggregation on splunkd_access.log events from your DS (there is a metrics series for the DS but it contains only the size of deployed apps so phonehomes don't count).
One caveat though - it will only contain the size of the payload as with the normal httpd access log. It won't account for all the lower layers - request and response headers, tcp overhead and so on.
Your deployment server should be sized based on the number of clients. Anything over 50 clients requires a dedicated server with the recommended specs of 12CPU cores and 12GB RAM.
It would be worth checking the following docs which covers the sizing requirements based on your environment. https://docs.splunk.com/Documentation/Splunk/9.4.1/Updating/Calculatedeploymentserverperformance
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing.
Hi @whitefang1726 ,
Deployment Server is a stand-alone Splunk server, so it requires at least 12 CPUs and 12 GB RAM.
if it has few clients to manage you can use reducted requirements, and if it has to manage many clientss, you could use more resourses.
Ciao.
Giuseppe