Deployment Architecture

Chronology of Splunk Deployment

sarwshai
Communicator

I need to build Splunk Distributed Environment, how should i configure the different components. I have License/Cluster Master, Indexers, search head and Deployment Server.

I am thinking of below chronology,

1. License/Cluster Master/Deployment Server
2. Indexers
3. search head
4. Heavy Forwarder

Is it right enough, or is there a better way? Also what precautions/prequisite should i keep in mind while deploying all these?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @sarwshai,
The order you defined it's correct, I'd change only Deployment Server:

  • it's correct to start from Master Node/License Master;
  • Search Peer should be configured immediately after MN (or in the same time);
  • Then Search Heads;
  • You can start with Deployment Server when you'll start with the periferals systems (Heavy and Universal Forwarders);
  • At this point you can start with the Heavy Forwarders;
  • ath the end you should start with Universal Forwarders.

Only some little hints:

  • forward the logs of all systems to the indexers,
  • configure a system as Monitoring Console and configure it: it should be better to use a dedicated server or, if you haven't an heavy load on the Master Node, you could use it, but not DS, Indexers and SHs.

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sarwshai,
The order you defined it's correct, I'd change only Deployment Server:

  • it's correct to start from Master Node/License Master;
  • Search Peer should be configured immediately after MN (or in the same time);
  • Then Search Heads;
  • You can start with Deployment Server when you'll start with the periferals systems (Heavy and Universal Forwarders);
  • At this point you can start with the Heavy Forwarders;
  • ath the end you should start with Universal Forwarders.

Only some little hints:

  • forward the logs of all systems to the indexers,
  • configure a system as Monitoring Console and configure it: it should be better to use a dedicated server or, if you haven't an heavy load on the Master Node, you could use it, but not DS, Indexers and SHs.

Ciao.
Giuseppe

sarwshai
Communicator

Thanks for the suggestion, one point to clarify. I am planning to configure DS on License/Cluster master itself due to hardware restrictions, will it work smoothly (because planning to keep all managment roles under one server)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sarwshai,
No: Deployment Server must be on a dedicated server when it manages more than 50 clients and anyway never can be shared with the Master Node.
You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Planadeployment#Deployment_server_and_ot... .

When you'll use a Search Head Cluster, you'll be able to configure Deployer on Master Node, but Deployment Server is an Heavy roale and cannot use shared hardware (when more than 50 clients to manage).

Ciao.
Giuseppe

sarwshai
Communicator

Thanks @gcusello for the info.

0 Karma

sarwshai
Communicator

@gcusello , still have one doubt, can i configure DS on Heavy Forwarder instead of License/Cluster master

0 Karma

gcusello
SplunkTrust
SplunkTrust

I don't like it! but if you cannot use a dedicated server (better!).
Ciao.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...