Splunk - Where is best to install heavy forwarder

[Robertoing]

Hi to all,

my Splunk architecture consist of: 4 SH, 2 Indexer, 1 Deployment-Server (includes Cluster Master and Deployer).

I need to install an heavy forwarder but I don't have availables machines; where is better to install a second Splunk Enterprise instance (Heavy Forwarder)?

Thanks to all.

[gcusello]

Hi @Robertoing,

at first Deployment Server can be shared with other roles only if it has to manage less than 50 clients and never with the Master Node, how many clients have you in your perimeter?

Then, as @SinghK asked: why 4 Search Heads? how you defined them? usually in a SH Cluster they are three, you need four SHS if you have many users and scheduled searches.

Then about Heavy Forwarders, what you need them, what's their role?

Anyway it's usually better to have at least two HFs to avoid Single point of Failues, especially if you use them as concentrators of other Universal Forwarders or as syslog servers, the only exception is when you use an HF as a pull server for cloud environments extractions.

Ciao.

Giuseppe

[SinghK]

is it a specific requirement that you need 4 SH in your environment?

[Robertoing]

Hi @SinghK ,

Correct.
Now, I need to install an heavy forwarder like a second Splunk Enterprise instance in one of those machines (SH, Indexer, Deployment-server): what do you suggest?   

Thank you.

[SinghK]

Then you need a extra server there is no other way to deploy a HF or you can do is remove one of your SH and make it a Heavy Forwarder.  Thats all I can think of...