Deployment Architecture

What are the steps and configuration require to make an instance as a Deployer

princemanto2580
Path Finder

Hi Guys,

Can anyone here help me out for a steps and configuration required to make an instance as only Deployer.

I gone through the below links, but it will be kind assiastance if anyone simplify it better.

http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/SHCdeploymentoverview#2._Set_up_the_dep...

https://answers.splunk.com/answers/268768/deployment-server-vs-deployer.html

http://docs.splunk.com/Documentation/Splunk/6.2.3/DistSearch/PropagateSHCconfigurationchanges

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you still are on 6.2.3 as indicated by the docs links, do upgrade to 6.5.2 - there have been many SHC improvements over the years.

The docs likely have improved as well, here's the current detailed list of what to do to set up your SHC - including deployer: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/SHCdeploymentoverview#Deploy_the_cluste...
If you're following that and still have questions, let us know what part doesn't work out for you.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you still are on 6.2.3 as indicated by the docs links, do upgrade to 6.5.2 - there have been many SHC improvements over the years.

The docs likely have improved as well, here's the current detailed list of what to do to set up your SHC - including deployer: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/SHCdeploymentoverview#Deploy_the_cluste...
If you're following that and still have questions, let us know what part doesn't work out for you.

martin_mueller
SplunkTrust
SplunkTrust

That's intentional, many settings should not be performed on one cluster member only. These should be deployed through the deployer to keep all cluster members in sync.
To avoid breaking things, only settings that are safe to set through the UI are exposed by default.

Relevant docs: http://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/HowconfigurationworksinSHC

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I highly recommend following the steps from the documentation, including running the init shcluster-config on every instance (necessary to tell the instance "you're now part of a cluster") and bootstrapping the captain (necessary to tell the cluster "go!").

Pushing step 1 from the deployer is not going to work, because step 1 is where the cluster members learn about the deployer.
Pushing step 2 from the deployer is not going to work, because it pushes apps to all members. Assigning a bootstrap captain is an operation you do on only one instance.

0 Karma

princemanto2580
Path Finder

One last understanding from you, hope you will help me out.

When I start making search head instance into cluster mood, why most of the options vanish from settings.

How can I keep all the options available intact after search head cluster inside setting.

0 Karma

princemanto2580
Path Finder

Hi martin_mueller,

Thanks for sharing the link. Based on that details, I configured the Deployer only up-to shclustering stanza.

[shclustering]
shcluster_label = new_cluster1
pass4SymmKey = $1$vZu7quK4ZPxUzEb7xd/1

Now my question are below:

  1. Do I need to still run the command on each instance of search head cluster splunk init shcluster-config -mgmt_uri https://SH1:8089 -replication_port 9200 -secret santabanta
  2. Do I need to still run the command assign one of the members as Captain and set the member list splunk bootstrap shcluster-captain -servers_list https://SH1:8089,https://SH2:8089,https://SH3:8089
  3. Is it possible to push these two (question 1 and question 2) configuration from Deployer via apps.
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...