Deployment Architecture

Deployment Server Separate from Heavy Forwarder

damo66a
Explorer

Hi everyone, 

 

Our deployment consists of an on prem deployment server, on prem heavy forwarder and Splunk Cloud. 

Is there a way of getting our separate Heavy Forwarder to recognise our deployment server, specifically so we can configure file inputs on the heavy forwarder using the deployment clients. 

I know they can be one in the same but we chose to have separate servers for operational reasons. Appreciate anyone's view/help

Tags (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @damo66a 

the deployment server can manage any splunk instance

anyway to configure the deployment server go on your HF and run this two comands

 

 

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

 

 

 

next step,  go on your deployment server and check if is present your HF

aasabatini_0-1619694798517.png

next step create a new serverclass

aasabatini_1-1619694848606.png

on your new serverclass  add client and apps

aasabatini_2-1619694896033.png

 

 

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

aasabatini
Motivator

Hi @damo66a 

yes, you can manage your HF from the DS, you need to create a dedicate serverclass for the HF and you can push all the configurations.

please check the documentation

https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Serverclassconf

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

damo66a
Explorer

thanks for the suggestion. 

ive looked over that link and cant see how it tells me to do that. my understanding of a deployment client is that you install the UF on the destination machine (auto configured by script) and it "dials home" to the deployment server, then we add it to a server class as needed. 

As ive already configured this server as a Heavy Forwarder, how would I go about adding it to a server class on the deployment server?

Also, My deployment server is a windows based machine, the heavy forwarder is linux based - not sure if that would have any baring at all. 

0 Karma

aasabatini
Motivator

Hi @damo66a 

the deployment server can manage any splunk instance

anyway to configure the deployment server go on your HF and run this two comands

 

 

splunk set deploy-poll <IP_address/hostname>:<management_port>
splunk restart

 

 

 

next step,  go on your deployment server and check if is present your HF

aasabatini_0-1619694798517.png

next step create a new serverclass

aasabatini_1-1619694848606.png

on your new serverclass  add client and apps

aasabatini_2-1619694896033.png

 

 

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

damo66a
Explorer

that did it. thanks very much for your help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...