Deployment Architecture

Warning at MC : "At least one of your instances is a deployment server plus other non-deployer roles"


Splunk MC while setting up in distributed mode has error : "At least one of your instances is a deployment server plus other non-deployer roles. We recommend only deployer roles per deployment server."

I have edited the role and kept - DS, KV store and LM together.

Basically in my infra, i have DS, LM and MC all on one box.

Why this warning is coming, i am not able to understand what this want to say and What shall i do to not get this warning?

0 Karma


The monitoring console is advising you of best practice from Plan a deployment

Because of high CPU and memory usage
during app downloads, it is
recommended that the deployment server
instance reside on a dedicated

While you do not have to do this, it is recommended as when the deployment server becomes overloaded it doesn't respond to other requests for a short period of time.
If your using "MC" as cluster master, I'd suggest you do not share the roles on the same server...

0 Karma


I wouldn't think your DS/LM would have KV store listed as a role as that's typically reserved for your search head/search cluster nodes, however that won't affect much. Even removing that, because you're configuring it as a license master it'll throw this warning. It's only a warning and doesn't affect anything. Splunk is just providing guidance that you typically want to designate single roles to your servers. These classifications are only used on the MC dashboards to filter what shows up where. You can safely ignore the message if your server is in fact configured for all those roles.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...