Im new to the splunk team in my organisation and they have servers A , B , C, D etc. There are splunk instances installed on the server like deployer , clustermaster , deployment-server etc. From their docs I know A - Clustermaster B- Deployer C - License master D - Deployment server etc.. But How do I know find out which instance is installed on any particular server? Is there any configuration file that corresponds to what instance is installed on the server? Could you help me in differentiating these?
You can find kind of Splunk servers in this way:
I don't know if you have clusters, in these cases you could find Deployer (in Search Head Clusters) and Master Node (in Indexers Cluster).
You could find Deployer seeing if in $SPLUNKHOME/etc/shcluster/apps there are your apps.
You can find Master Node if in $SPLUNKHOME/etc//master-apps/_cluster/local (or default) there are your indexes.conf.
What makes a Deployment Server a Deployment Server is the presence of a
serverclass.conf file (whether or not any Deployment Clients are pointed to it or not):
FYI, Splunk Enterprise includes all of the above as part of the installation. However, the only features enabled by default are search and index. To turn on the other features you need to configure them as desired on each server (and forwarders where applicable).