Deployment Architecture

Deployment server

annebeate
Path Finder

Hi,

We are planning to migrate our Splunk environment to new servers and in the same process upgrade from version 5.01 to the latest version (6.01). We are currently using deployment server to distribute configuration to splunk universal forwarders. My question is: can a deployment server receive it's configuration from another deployment server? That is, can a deployment server act as both a deployment client and a deployment server? We currently have aprox 150 Splunk universal forwarders. We are planning to use intermediate forwarders between the splunk universal forwarder and the index servers.

Best regards,
Anne

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Short answer: Yes.

Long answer: I wouldn't, but it is possible. It's all a matter of whitelists and app assignments. I'm curious - why the intermediate forwarders? Splunk works best with direct connections to the indexers. I have 2 intermediate heavy forwarders - they are used for syslog processing as well as some JMX and ActiveQueue stuff - not traffic control.

Come to IRC! Meet us in #splunk on EFNet!

alacercogitatus
SplunkTrust
SplunkTrust

If this answered your questions, please mark it accepted. Thanks!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Not sure if you need that for your environment - although I do recommend the syslog-ng approach with a Heavy forwarder. It could be best for you, I'd have to know more :D. If your question has been answered, please accept it. Thanks!

0 Karma

annebeate
Path Finder

Thanks 🙂 We found a recommendation to use intermediate forwarders in this document: http://www.aplura.com/docs/Splunk_Best_Practices.pdf.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...