Deployment Architecture

Recommended Deployment Server Size

whitefang1726
Path Finder

Hello Guys,

I have an existing deployment server and I'm reviewing the average network bandwidth of the server. That could help me before migrating the server into a new box. Any thoughts? Thanks!

Labels (1)
0 Karma

whitefang1726
Path Finder

I think I haven't put the correct question. So right now we have a deployment server will need to migrate it into Cloud.  I think the possibly biggest concern for us is the network latency in Cloud from/to the target endpoints. Is there a search query that can help and check the network traffic actively flowing? 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As @isoutamo already pointed out "migrate to Cloud" is a bit ambiguous term. As far as I remember if you're using Splunk Cloud, you still need to set up DS on your own (that's one of the uses for the 0-byte ingest license).

If you're simply migrating from on-prem installation to a cloud-based (GCP, AWS or any other provider really) Splunk Enterprise installation, you can put your DS there. A DS is not that sensitive to latency so it shouldn't matter that much.

There are other things to consider however - if your DS were to be exposed to the internet instead of connected to your network via VPN you will probably want to use deployment client authentication. You might also want to raise the phone home interval (which you normally probably should do anyway even with an on-prem setup) to lower load on DS and save on outgoing traffic (which you might be billed on in case of many cloud providers).

The amount of traffic will depend on the number of clients, phone home frequency, size of your apps and frequency of changes in apps.

You should be able to do some aggregation on splunkd_access.log events from your DS (there is a metrics series for the DS but it contains only the size of deployed apps so phonehomes don't count).

One caveat though - it will only contain the size of the payload as with the normal httpd access log. It won't account for all the lower layers - request and response headers, tcp overhead and so on.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
What you are meaning with “migrate to Cloud”? Are you moving it from onprem to some cloud platform like AWS, GCP or Azure? Or are you migrating your splunk servers (indexers, SHs etc) into SCP?
If 1st one, then it’s just like any other server and everything is depending on your network latency and throughput. If/when those are enough for other servers, then there shouldn’t be any issues.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
As usually this depends on your environment. How many clients you have, how many apps, how many serverclass etc. Are there lot of changes etc.
As said splunk recommend dedicated server when you have more than 50 clients. In real life if you have small/medium size environment, you don’t need 12cpu 12gb node. You could start with smaller virtual node, monitor it and increase it size when needed.

livehybrid
SplunkTrust
SplunkTrust

Hi @whitefang1726 

Your deployment server should be sized based on the number of clients. Anything over 50 clients requires a dedicated server with the recommended specs of 12CPU cores and 12GB RAM. 
It would be worth checking the following docs which covers the sizing requirements based on your environment. https://docs.splunk.com/Documentation/Splunk/9.4.1/Updating/Calculatedeploymentserverperformance

 

🌟 Did this answer help you? If so, please consider:

    • Adding karma to show it was useful
    • Marking it as the solution if it resolved your issue
    • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @whitefang1726 ,

Deployment Server is a stand-alone Splunk server, so it requires at least 12 CPUs and 12 GB RAM.

if it has few clients to manage you can use reducted requirements, and if it has to manage many clientss, you could use more resourses.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...