Getting Data In

how to define which heavy forwarder instances to deploy apps?

vnguyen46
Contributor

Hello - I have 3 HFs and about 150 UFs and 1 deployment server and other instances. In a new configuration, how can I use the DS to deploy apps to only these 3 HFs and UFs, not to other instances?

Thank you,

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @vnguyen46,
the server managed by Deployment server are choosen in ServerClasses on the DS!
So put in your ServerClasses only the server that you want to use for deployng not other instances.
If you don't want neither that other instaces are connected to DS, you can modify deploymentclient.conf on these instances removing the DS address.
In addition, I don't know which king of other instaces you have, but if you have clusters, you cannot use DS, so which are these additional instances?

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Aboutdeploymentserver

Ciao.
Giuseppe

View solution in original post

0 Karma

vnguyen46
Contributor

Hi Giuseppe - Feeling fortunate every time I get help from you. Quick background, I take over an imperfect configured system and now am running out of time migrating to a new system. I can share lesson learned on this project if you'd like to know - email: vinhusa@gmail.com. For now, I'd like to be certain on which CLI commands I can run to push indexes to the index cluster and which ones to push apps to HF/UFs. I have: splunk reload deploy-server and splunk apply cluster-bundle
Are you familiar with these commands?

Thank you,

0 Karma

gcusello
Esteemed Legend

Hi @vnguyen46,
the server managed by Deployment server are choosen in ServerClasses on the DS!
So put in your ServerClasses only the server that you want to use for deployng not other instances.
If you don't want neither that other instaces are connected to DS, you can modify deploymentclient.conf on these instances removing the DS address.
In addition, I don't know which king of other instaces you have, but if you have clusters, you cannot use DS, so which are these additional instances?

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Aboutdeploymentserver

Ciao.
Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @vnguyen46,
as I said, if you have an Indexer Cluster you cannot use the Deployment Server to deploy Apps to search peers, but only Master Node, you can find all the infos you need at https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/Aboutclusters .
The command splunk apply cluster-bundle can be used for clusters, but I prefer using the same feature by web interface.

The command splunk reload deploy-server is used on DS only to force apps deploy to all targets, as I said read carefully at https://docs.splunk.com/Documentation/Splunk/8.0.0/Updating/Aboutdeploymentserver there are all the infos you need.
Anyway, the main issue isn't the command to force deploy (this is the last thing!), it's design a complete and correct Deployment Plan, designing on paper (or Excel) the ServerClasses you need and for each one: host members and apps to deploy avoiding duplications and lacks.

In this plan I suggest (if you didn't) to add an additinal app containing only two files: outputs.conf and deploymentclient.conf.
In this way you can manage all by DS.

Ciao and next time.
Giuseppe

0 Karma

vnguyen46
Contributor

Giuseppe - Really appreciate your help.

0 Karma
Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...