Hi @AMAN0113 ,
it's possible to share the DS only if it has to manage less than 50 clients.
Even if, the most work in on the devices:
if you are managing the addressing od the Deployment Server using a dedicated app, it's very easy to move the DS to another server, if not it's better to move the other servers.
Anyway, To move the DS, you should create a custom Add-On, called e.g. TA_deploymentClient, containing only two files:
- apps.conf
- deplymentclient.conf
So these are the steps to move the DS:
- on the old DS, add a new serverclass for all clients pointing to the new add-on TA_deploymentClient
- on all clients remove deploymentclient.conf from the %SPLUNK_HOME/etc/system/local folder
- restart Splunk on all clients
- verify (on the DS) that in all clients there's a new app installed
- install Splunk on a new system,
- copy apps from $SPLUNK_HOME/etc/deployment-apps to the same folder of the new system
- copy %SPLUNK_HOME/etc/system/local/serveclasses.conf in thesame folder of the new system,
- push new new configurations
To move the HEC, you have to re-create the inputs, eventually using the same tokens, but, in the devices, you have to point to the new destination.
It could be easier if you have a Load Balancer in front of the the HEC servers, becausein this case, you have only to modify the configuration in the LB.
Same thing for the syslog receivers: you have to copy all the inputs from th old to the new servers and then move the pointing adresses in each device.
See what' the highest number of connection you have (syslog, clients or HEC) and maintain it in the original server, moving the others.
Ciao.
Giuseppe
