Deployment Architecture

How to decommission a Deployment Server without removing the apps it has deployed?

anewell
Path Finder

We have a Deployment server within our Splunk estate. For a variety of political & operational reasons, we have decided to do endpoint configuration management using different tools.

How do I decommission a Deployment Server without removing the Apps it has deployed? I do not want to disturb the existing configuration state for client endpoints. Am I looking at removing deploymentclient.conf from each endpoint individually? It seems that any other approach - Removing server classes, removing apps, etc. will result in client endpoints deleting their local copy of the app.

One approach I was considering - Would it work if I point the DNS record for my existing DS to a new Deployment Server instance, one that is minimally configured. Does that result in the endpoint removing the apps managed by the prior DS?

Thanks for any thoughts or guidance.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

If you have a new, minimally-configured deployment server that you point to with the DNS record, the apps already deployed to the forwarders will probably be removed. If the forwarders can't talk to a deployment server, they don't make any changes to their apps.

I suggest that you just turn the deployment server service off on your current deployment server, and it should work fine. They will not talk to a deployment server, they won't make changes (remove apps) and you can modify the apps' files that are on the hosts. The forwarders will still try to contact the deployment server, so you may wish to change the deploymentclient.conf file (the one that you deploy) to only contact (phone home) the deployment server once a week so that it won't do that too much on the forwarders, but you could revive your deployment server in the future.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...