Deployment Architecture

Best practice to give deployment server detail in universal forwarders

rameshlpatel
Communicator

Hi,

In my enterprise I am adding 50+ universal forwarders.

But give deployment server information what is best practice. Give DS details at Universal forwarder installation time or adding deploymentclient.conf under system/local folder ?

0 Karma

dstaulcu
Builder

use a dns alias for references to deployment server name wherever possible to maximize flexibility down the road

0 Karma

rameshlpatel
Communicator

Please can you put more light on this by example or tutorial ?

0 Karma

lukejadamec
Super Champion

If you plan on creating a new deployment server in the future with a different IP, or you plan to create a multiple deployment server set up in the future, or if you just want more control from your deployment server, then you should not put the deploymentclient.conf file in the system\local folder because you can't change that from the centrally managed deployment server. In this case, you want to move or create the deploymentclient.conf file in a new folder in the splunk\etc\apps\ directory - make sure you use the same folder name on all like clients because it can managed by the deployment server.

If there is no chance that the IP of the deployment server will change, or it is not a very big deal to change the deploymentclient.conf one server at a time then configure the deployment server at install time in the default location, and let it run.

lukejadamec
Super Champion

The deploymentclient.conf will be read on restart of the forwarder (splunkd) service. You will need to remove the deploymentclient.conf from the system\local folder if one exists.

0 Karma

rameshlpatel
Communicator

Yes I am preferring your first option. But deploymentclient.conf in app folder we can add through deployment server itself (creating folder inside deployment-app folder). So at first to register client with deployment server how we can do that ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...