I apologize if the title isn't very descriptive of the question I have, was not sure how to best frame it.
For a setup with numerous splunkforwarders forwarding to two indexing servers, and getting inputs/outputs from a deployment server, how is the network flow?
splunkforwarder -> splunk-index1/2 - is this forwarder-initiated?
splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts?
I believe I found some information on this at some point, but that was for an older version and possibly outdated.
Thanks, just so I am sure I properly understand this:
splunkforwarder -> indexers # this is forwarder-polling/initiated on port 9997.
splunkforwarder -> deployment # this is also forwarder-polling/initiated, port 8089.
indexer/deployment/head -> license server # this is indexer/deployment/head-polling on port 8089.
So overall, splunkforwarders initiates every connection to their mothership. And splunk servers initiates connections to the license server.
Hi @mart10
splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts? ///
on Deployment server, when you make changes (to inputs.conf, etc), the changes will be sent to universal forwarders - In some cases, it deploys apps automatically. In other cases, you need to manually initiate the deployment.
https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Updateconfigurations
The phone home interval (that is, how frequently each client checks in with the deployment server for updates)
https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Calculatedeploymentserverperformance
phoneHomeIntervalInSecs = <number in seconds> * Determines how frequently, in seconds, this deployment client should check for new content. * Fractional seconds are allowed. * Default: 60.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Deploymentclientconf