Using the same machine for deployment server and heavy forwarder

[anglewwb35]

I would like to know if it possible to use the same machine for both a Deployment Server and a Heavy Forwarder. If so, would I need two different licenses for this machine？ Or can I simply use the Forwarder license while utilizing the functions of both the Deployment Server and Heavy Forwarder？Thank you so much

[gcusello]

Hi @anglewwb35 ,

adding only few additional information to all the ones of @livehybrid and @kiran_panchavat:

The limit of a dedicated Deployment Server is 50 clients to manage:

if it has to manage more than 50 clients it must be dedicated;

in addition even if it has to manage less than 50 clients it's also relevant the load on the HF because the DS role is an heavy job for the machine and you could compromize the parsing activities done by the HF.

Then, on the Deployment Server you need a license, so you should connect it to your License Manager (not using a dedicated or a Free License), anyway it doesn't consume license because it doesn't locally index nothing, infact it's a best practice to forward all internal logs of all machines of the Splunk infrastructure to the Indexers.

On the Heavy Forwarder, you can use a Forwarder License (not a Free License!), but only if you perform a normal forwarding, if you need e.g. to use DB-Connect, you need a License, so you have to connect also HFs to the License Manager.

Ciao.

Giuseppe

[isoutamo]

One more comment which is mandatory to know.

You cannot manage DS itself with DS functionality! Don't even try it!!!

For that reason it's good to use dedicated DS server if/when you have several clients to manage. DS can be a physical or virtual server. It's no mater if there are enough resources for it. Currently you can even make pool of DSs as working like one.

If you are Splunk Cloud customer you can order dedicated DS license from Support by creating a service ticket. I have never try if I can do this also as Splunk Enterprise customer too?

After 9.2 there are some new configuration options what you must to do in DS especially if/when you are forwarding it's log to centralized indexers.

[livehybrid]

Hi @anglewwb35 

You arent able to use the free license on a server that you plan to use as a Deployment as server as Deployment management capabilities are not available on the free license.

There is nothing technically stopping you using your Heavy Forwarder (HF) as a Deployment Server (DS) - infact the docs state "If the deployment server has less than 50 clients, you can co-locate the deployment server on an ind..." which would also cover your usecase of running the DS on your HF. 

So, if you are looking to run the DS on your HF and you have less than 50 clients then you should* be okay, however you should read those pages of the docs to understand any caveats etc.

Note - the number 50 isnt a hard limit as such (It wont just stop) but could introduce unknown issues if pushed further.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[kiran_panchavat]

@anglewwb35 

The deployment server must be on a dedicated server. 

In other words, you have to use it only to manage clients, it isn't relevant that you disable the other roles (dedicated server means just this requirement, don't use it for any additional role, also forwarding!)

[kiran_panchavat]

@anglewwb35 

For a heavy forwarder (HF), you should set up one of the following options:

1) Make the HF a slave of a license master. This will give the HF all of the enterprise capabilities, and the HF will consume no license as long as it does not index data.

2) Install the forwarder license. This will give the HF many enterprise capabilities, but not all. The HF will be able to parse and forward data. However, it will not be permitted to index and it will not be able to act as a deployment server (as an example). This is the option I would usually choose. (Note that the Universal Forwarder has the forwarder license pre-installed.)

I strongly discourage using either the trial license or the free license on a production forwarder.

Licenses and distributed deployments - Splunk Documentation