Deployment Architecture

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ?

ashrafk
Explorer

Why is it not recommended to use deployment server for deploying config bundles to Search head cluster ? Why do we need a separate deployer instance and how is a deployer different from a deployment server ?

0 Karma
1 Solution

manjunathmeti
Champion

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

View solution in original post

manjunathmeti
Champion

SHC (Search head cluster) deployer is used to push search heads apps to search head cluster members.

Deployment is used to push apps/add-ons to forwarders and to standalone splunk instances (like search heads, indexers) called deployment clients.

And also deployment server overwrites run-time updates done in the apps so it cannot used to push search head apps to search head cluster members as users do update these from splunk UI, so deployer is used.

You can configure a single splunk instance to both, as a deployer server and a deployment server if you don't have too many deployment clients.

ashrafk
Explorer

Thank you for the response it really helped me understand the difference. Just one query though, when you say "deployment server overwrites run-time updates" , can you please elaborate what kind of updates (as an example).

0 Karma

manjunathmeti
Champion

Run time changes means changes in splunk knowledge objects (like lookups, macros, tags etc.), reports and dashboards that are part of apps. When you update these from splunk UI a local directory will be created in the apps and updates will be stored there.

If deployment server is used then it'll overwrite these updates.

Deployer server doesn't update local directory (unless you make it). And it makes sure that all the search heads in the cluster have same apps and configurations.

0 Karma

ashrafk
Explorer

Thank you so much Manjunath !! You are a Rockstar !! 🙂

0 Karma

manjunathmeti
Champion

You're welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...