Stripping down dedicated deployment server?

[mfrost8]

We built a dedicated deployment server a while back when we started noticing (thanks to Splunk support) that running it in the same Splunk indexer was interfering with indexing operations a little. So we now have a dedicated deployment server instance that also runs on one of the indexer hosts.

It seems as if the deployment server, while more than a fileserver, is really doing considerably less than a full Splunk server, yet that's what the basic file tree for the deployment server is. I realize there isn't a separate deployment server only package like the universal forwarder (maybe someday?), but I'm wondering if there isn't some way that one can turn off more things in the Splunk deployment server to lighten its footprint.

I realize that I can turn off splunkweb and can tune the phonehome intervals. I don't suppose that other things can be turned off in the same vein as say things that were turned off in the lightweight forwarder to make the deployment server smaller?

Thanks!

[jrodman · Accepted solution]

It's a valid idea. We haven't done all that legwork.

You could downsize the logs in log.cfg. You could play with fire in default-mode.conf but its quite easy to get into some unpleasant state that way.

If the memory use is unworkably large, maybe we should investigate. If its I/O etc, we should just turn off the inputs, or make it forward its logs elsewhere.

If its just the installed size, I doubt its worth your time.