Deployment Architecture

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ?

ashrafk
Explorer

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ? Why do we need a separate deployer instance and how is a deployer different from a deployment server ?

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

ashrafk
Explorer

Thank you for the response it really helped me understand the difference. Just one query though, when you say "deployment server overwrites run-time updates" , can you please elaborate what kind of updates (as an example).

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Run time changes means changes in splunk knowledge objects (like lookups, macros, tags etc.), reports and dashboards that are part of apps. When you update these from splunk UI a local directory will be created in the apps and updates will be stored there.

If deployment server is used then it'll overwrite these updates.

Deployer server doesn't update local directory (unless you make it). And it makes sure that all the search heads in the cluster have same apps and configurations.

0 Karma

ashrafk
Explorer

Thank you so much Manjunath !! You are a Rockstar !! 🙂

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You're welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Why getting timeout error while adding data to the Splunk cloud index from REST API?

Hello Team,<BR /><BR />I am getting timeout error while adding data to Splunk cloud index from REST API. I am ...

Is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER?

My UF-HF-Indexers is working great however I need to add a HF-HF-Indexer as well The first HF sends to other ...

How to write query for including non business hours and weekends

Hi ,I need a query for including non business hours and weekends