Deployment Architecture

Stripping down dedicated deployment server?

mfrost8
Builder

We built a dedicated deployment server a while back when we started noticing (thanks to Splunk support) that running it in the same Splunk indexer was interfering with indexing operations a little. So we now have a dedicated deployment server instance that also runs on one of the indexer hosts.

It seems as if the deployment server, while more than a fileserver, is really doing considerably less than a full Splunk server, yet that's what the basic file tree for the deployment server is. I realize there isn't a separate deployment server only package like the universal forwarder (maybe someday?), but I'm wondering if there isn't some way that one can turn off more things in the Splunk deployment server to lighten its footprint.

I realize that I can turn off splunkweb and can tune the phonehome intervals. I don't suppose that other things can be turned off in the same vein as say things that were turned off in the lightweight forwarder to make the deployment server smaller?

Thanks!

Tags (1)
1 Solution

jrodman
Splunk Employee
Splunk Employee

It's a valid idea. We haven't done all that legwork.

You could downsize the logs in log.cfg. You could play with fire in default-mode.conf but its quite easy to get into some unpleasant state that way.

If the memory use is unworkably large, maybe we should investigate. If its I/O etc, we should just turn off the inputs, or make it forward its logs elsewhere.

If its just the installed size, I doubt its worth your time.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

It's a valid idea. We haven't done all that legwork.

You could downsize the logs in log.cfg. You could play with fire in default-mode.conf but its quite easy to get into some unpleasant state that way.

If the memory use is unworkably large, maybe we should investigate. If its I/O etc, we should just turn off the inputs, or make it forward its logs elsewhere.

If its just the installed size, I doubt its worth your time.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...