How can I deploy forwarders prior to Splunk servers (indexer, deployment server)?

[halr9000]

For non-technical reasons, I need to plan the deployment of forwarders before the Splunk server infrastructure is in place. What factors need to be considered, and what is the minimal configuration that can be placed on the forwarders, such that the agents can be deployed in a dormant state, and then activated at a later time when the index tier is ready?

Also, is deployment server a requirement in such a scenario?

[aholzer · Accepted solution]

Do you have the future IP and port you will use for the deployment server? That's really the only piece of informantion you'd need in order to have "dormant" forwarders set up and ready once you get the deployment server ready.

After you install the forwarder you'd have to configure the "deploymentclient.conf" to point to your future deployment server and turn on polling (command: ./splunk set deploy-poll deployment-server:mgmtPort -auth admin:changeme1). If you don't do this, you'll have to later manually do both of the above before they start communicating with your deployment server.

[halr9000]

I'm asking for a colleague, so let's assume yes, the deployment server can be defined in advance. I'll convert your comment to an answer so you get credit.