How do I make my heavy forwarder, which is already configured, into a deployment server?

[kdelvillar]

I have a Splunk Cloud instance and a heavy forwarder that sends in all my data into my cloud instance. I will now be installing a universal forwarder to get Windows Active Directory data in and will point my universal forwarder to my heavy forwarder. Now, my question is how do I make my heavy forwarder that is already configured into a deployment server as well? I would also like to know how do I know if my heavy forwarder is already set up as a deployment server? (I didn't set up the HF someone else did)

Thanks

[vincenteous]

Hi,

Technically you can install your UF and then point the deployment server to your currently existing HF. And then, you can check your UF's availability using your HF's Web GUI in "Settings --> Forwarder Management" menu. Once you can see your UF, you can then create a server class and push app to that UF.

Make sure to have a firewall rule (if there's firewall in between) to allow communication between your UF and HF on port 8089 or any other management port you use. To confirm the connection from your UF side, see splunkd.log and find entry which contains "Handshake".

Hope it helps.

[dkeck]

Please accept the answer if it was helpful

[dkeck]

Its is recommended to install your DS on a dedicated server, not on a HF.

So if you expect to have a high number of Clients (100+) choose a dedicated server , or at least a SH or your License Master

You can check on each splunk instance if its a deployment server by simple clicking on the settings -> forwarder management tab
or check $SPLUNK_HOME/etc/deployment-apps, any apps in there, its at least ready to be a DS.

This is also the way to "actived" the DS function just add apps to $SPLUNK_HOME/etc/deployment-apps