Getting Data In

How can I deploy forwarders prior to Splunk servers (indexer, deployment server)?

halr9000
Motivator

For non-technical reasons, I need to plan the deployment of forwarders before the Splunk server infrastructure is in place. What factors need to be considered, and what is the minimal configuration that can be placed on the forwarders, such that the agents can be deployed in a dormant state, and then activated at a later time when the index tier is ready?

Also, is deployment server a requirement in such a scenario?

0 Karma
1 Solution

aholzer
Motivator

Do you have the future IP and port you will use for the deployment server? That's really the only piece of informantion you'd need in order to have "dormant" forwarders set up and ready once you get the deployment server ready.

After you install the forwarder you'd have to configure the "deploymentclient.conf" to point to your future deployment server and turn on polling (command: ./splunk set deploy-poll deployment-server:mgmtPort -auth admin:changeme1). If you don't do this, you'll have to later manually do both of the above before they start communicating with your deployment server.

View solution in original post

aholzer
Motivator

Do you have the future IP and port you will use for the deployment server? That's really the only piece of informantion you'd need in order to have "dormant" forwarders set up and ready once you get the deployment server ready.

After you install the forwarder you'd have to configure the "deploymentclient.conf" to point to your future deployment server and turn on polling (command: ./splunk set deploy-poll deployment-server:mgmtPort -auth admin:changeme1). If you don't do this, you'll have to later manually do both of the above before they start communicating with your deployment server.

halr9000
Motivator

I'm asking for a colleague, so let's assume yes, the deployment server can be defined in advance. I'll convert your comment to an answer so you get credit.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...