Deployment Architecture

How to deploy application in cluster environment?

BansodeSantosh
Explorer

I have created an application which contains all configuration of Index, Data Input, Sourcetype, Lookup, Fields and view and Dashboards.

I want to put all visualization (Dashboards) on Search Head and all other configuration of Data Input, Index, Lookup and Fields on Indexer.

Please suggest if you have any idea bout how to do this in cluster environment.

Highly appreciate your help.

Thanks.

0 Karma
1 Solution

koshyk
Super Champion

First of all, I wouldn't put all config items into a single app. I would put into multiple apps
1. Inputs which is used for collections only. Need to send to ONLY forwarders
2. addon which contains all the brain (eg extractions, regex logic, transformations etc.). deploy to Search Head cluster, Heavy forwarders & Indexers
3. DA/TA which contains the dashboard and front-end stuff - deploy only to Search Heads

Then for distributed deployment
- You need deployer to deploy to Search Head cluster. Just copy the apps to $SPLUNK_HOME/etc/shcluster/apps/ in the deployer and do a bundle deploy
- You need a cluster master to deploy to Indexer cluster. Copy the required TA's/addons to $SPLUNK_HOME/etc/master-apps/ and do a bundle deploy to indexer slaves
- For forwarders/HF , you can use deployment-server $SPLUNK_HOME/etc/deployment-apps/

How to set them up is shown by various documentation

View solution in original post

koshyk
Super Champion

First of all, I wouldn't put all config items into a single app. I would put into multiple apps
1. Inputs which is used for collections only. Need to send to ONLY forwarders
2. addon which contains all the brain (eg extractions, regex logic, transformations etc.). deploy to Search Head cluster, Heavy forwarders & Indexers
3. DA/TA which contains the dashboard and front-end stuff - deploy only to Search Heads

Then for distributed deployment
- You need deployer to deploy to Search Head cluster. Just copy the apps to $SPLUNK_HOME/etc/shcluster/apps/ in the deployer and do a bundle deploy
- You need a cluster master to deploy to Indexer cluster. Copy the required TA's/addons to $SPLUNK_HOME/etc/master-apps/ and do a bundle deploy to indexer slaves
- For forwarders/HF , you can use deployment-server $SPLUNK_HOME/etc/deployment-apps/

How to set them up is shown by various documentation

guru865
Path Finder

@koshyk . I think you meant deployer instead of - You need Deployer to deploy apps to Search Head cluster. Just copy the apps to $SPLUNK_HOME/etc/shcluster/apps/ in the deployer and do a bundle deploy

koshyk
Super Champion

Thanks @guru865 . My mistake . I've amended accordingly. Upvoted for pointing out the mistake

0 Karma

dineshraj9
Builder

I think you should read the Distributed Deployment Manual - http://docs.splunk.com/Documentation/Splunk/6.5.3/Deploy/Distributedoverview

This will help you understand how to configurations are to be deployed in clustered and non-clustered environments.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...