Deployment Architecture

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ?

ashrafk
Explorer

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ? Why do we need a separate deployer instance and how is a deployer different from a deployment server ?

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

ashrafk
Explorer

Thank you for the response it really helped me understand the difference. Just one query though, when you say "deployment server overwrites run-time updates" , can you please elaborate what kind of updates (as an example).

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Run time changes means changes in splunk knowledge objects (like lookups, macros, tags etc.), reports and dashboards that are part of apps. When you update these from splunk UI a local directory will be created in the apps and updates will be stored there.

If deployment server is used then it'll overwrite these updates.

Deployer server doesn't update local directory (unless you make it). And it makes sure that all the search heads in the cluster have same apps and configurations.

0 Karma

ashrafk
Explorer

Thank you so much Manjunath !! You are a Rockstar !! 🙂

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You're welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Running multiple macros in the same search

Hi all!I'm trying to run multiple macros in the same search and eventually aggregate the results from each ...

Logic of Compound Subsearch with inputlookup

I'm struggling to create a search using an inputlookup and multiple NOT searches.Background: I have an ...

Tagging Heavy Forwarders

This is a tip, not a question.&nbsp;<span class="lia-unicode-emoji" ...