Getting Data In

Splunk UF Deployment - Possible Issues

johann2017
Explorer

Hello. We are planning on deploying UFs across our enterprise ~ 3000 systems. Currently, we have deployed UFs to 50 systems and have seen no issues. Before doing a large deployment to cover our entire enterprise - I was curious if anyone has seen any issues arise from deploying UFs?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A single deployment server can easily handle that many UFs. Just remember to set phoneHomeIntervalInSecs to 600 or so (default is 60 seconds) in deploymentclient.conf.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

The rule of thumb is 1KUFs/1-minute of phone-home with default settings. The default is 1-minutes so 1K servers with default settings before you run into scaling problems.

0 Karma

burwell
SplunkTrust
SplunkTrust

If you are able to monitor the UF _internal log, you can possibly detect issues. The classic issue is that they maxthruput throttles the UF and the UF will get their data indexed in burtsts. If they roll logs they might miss events.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A single deployment server can easily handle that many UFs. Just remember to set phoneHomeIntervalInSecs to 600 or so (default is 60 seconds) in deploymentclient.conf.

---
If this reply helps you, Karma would be appreciated.
0 Karma

johann2017
Explorer

Thanks rich! Have you seen any other issues arise on the network, endpoints, servers or anything else or "gotchas" from mass deploying the UFs?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In general, no. UFs are very straightforward to deploy. Problems are always possible, however, if you exceed the capacity of any of your resources.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...