Deployment Architecture

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ?

ashrafk
Explorer

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ? Why do we need a separate deployer instance and how is a deployer different from a deployment server ?

0 Karma
1 Solution

manjunathmeti
Champion

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

View solution in original post

manjunathmeti
Champion

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

ashrafk
Explorer

Thank you for the response it really helped me understand the difference. Just one query though, when you say "deployment server overwrites run-time updates" , can you please elaborate what kind of updates (as an example).

0 Karma

manjunathmeti
Champion

Run time changes means changes in splunk knowledge objects (like lookups, macros, tags etc.), reports and dashboards that are part of apps. When you update these from splunk UI a local directory will be created in the apps and updates will be stored there.

If deployment server is used then it'll overwrite these updates.

Deployer server doesn't update local directory (unless you make it). And it makes sure that all the search heads in the cluster have same apps and configurations.

0 Karma

ashrafk
Explorer

Thank you so much Manjunath !! You are a Rockstar !! 🙂

0 Karma

manjunathmeti
Champion

You're welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...