Introducing Splunk DS to an existing Splunk environment


We have an existing environment with 100+ servers sending data to IDX. We never had a DS before and now we want to introduce DS so that it's easier to manage the client. 

What are the things I consider before I start planning? Which config files I should be worried about getting overwritten when I add the existing UF as client to my DS.


Labels (1)
0 Karma

Esteemed Legend

Hi @varad_joshi,

I have two main hints before starting this job:

1) make a very accurate planning of your Serverclasses:

  • in other words, create in Excel (or something similar) a list of you servers, listing the TAs (Technical Add-Ons) to deploy in each one;
  • then think to the serverClasses to implement: a ServerClass is a table that make an association between a group of server (with the same TA to deploy) and the TAs to deploy.

This operation is very very important to avoid to have too many ServerClasses and heavy management..

Remember that the apps non listed in ServerClasses will be deleted from the servers!

2) create at least one TA (called e.g. TA_Forwarders) that contain only three files:

  • apps.conf (describing the app)
  • outputs.conf (containing the addressing of the indexers to send data);
  • deploymentclient.conf (contaioning the address of the Deployment Server).

the number of TA_Forwarders depends on your architecture: you need at least one TA, but you could have more of them if you have Heavy Forwarders as concentrators.

If possible, delete (e.g. using a script) the actual outputs.conf.



0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...