Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ?

[ashrafk]

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ? Why do we need a separate deployer instance and how is a deployer different from a deployment server ?

[manjunathmeti · Accepted solution]

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

[ashrafk]

Thank you for the response it really helped me understand the difference. Just one query though, when you say "deployment server overwrites run-time updates" , can you please elaborate what kind of updates (as an example).

[manjunathmeti]

Run time changes means changes in splunk knowledge objects (like lookups, macros, tags etc.), reports and dashboards that are part of apps. When you update these from splunk UI a local directory will be created in the apps and updates will be stored there.

If deployment server is used then it'll overwrite these updates.

Deployer server doesn't update local directory (unless you make it). And it makes sure that all the search heads in the cluster have same apps and configurations.

[ashrafk]

Thank you so much Manjunath !! You are a Rockstar !! 🙂

[manjunathmeti]

You're welcome 🙂