Splunk Cloud Hybrid Infrastructure

[kruane]

So I have Splunk Cloud, but we still use a Heavy Forwarder, Universal Forwarder and a Deployment server. The UF server has definitely come into hand for grabbing local data. However, I'm not sure what the Deployment server is for. We do use the Heavy Forwarder for various things. 

Does anyone have documentation of what is necessary and what is a nicety? And do they have knowledge on the specs needed? 

[richgalloway]

Strictly speaking, none of it is necessary, but it does make it easier to get data into Splunk.  😃

You already use the UF and HF so you must have found them necessary for doing certain things.  There may be other ways to do those things, but don't fix what isn't broken.

The Deployment Server is there to help manage your UFs.  Without a DS, you have manage each UF separately and manually (unless you have automation to help).

For more about the DS and what is does, see https://docs.splunk.com/Documentation/Splunk/9.2.1/Updating/Aboutdeploymentserver#What_is_deployment... .  The system requirements are at https://docs.splunk.com/Documentation/Splunk/9.2.1/Updating/Planadeployment#Deployment_server_system...

System requirements for UFs are at https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/Deploy