Deployment Architecture

Splunk Deployment Server: What is the largest possible number of entries in serverclass.conf?

lisaac
Path Finder

I am working on automating enrollments for a deployment server. I am working with a CMDB that has 25K hosts with over 1k applications. Each host in the CMDB is mapped to an application. For now, assume there is a one to one relationship of host to application.

Each application has a unique 4 digit code, and the code isn't reused. I plan to include the 4 digit code in the name of a forwarder app and in the name of the server class. The serverclass whitelist will include hosts mapped to the application. As you could imagine, the serverclass.conf could very easily grow to 25-50K lines.

Does anyone know if the size of the serverclass.conf file will be an issue? Does anyone in the field have similiar sized serverclass.conf file? Our environment consists of 5-8 deployment servers. We have a single primary deployment server, and we synchronize secondary deployment servers from the primary with rsync. The splunk version is 6.3.

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi lisaac, I've had experience with hundreds of applications with thousands of clients, and have found the biggest issue was utilizing the web interface for deployment server. I think that the known issues indicate this. With a growing number clients/apps, you'll have serious issues using the deployment server console.

Of course, you can still do whatever you want from the command/conf files.

To answer the question, I don't think there would be any problem with the operation of the deployment server in principle. Depending on how many clients are checking in to each individual DS, you'll need to increase the phonehome interval so the clients aren't hammering the server. Beyond that, it's a simple process where client checks in, compare's checksums of the app to the app on the DS, and then downloads and unpacks as needed.

Please let me know if this answers your question 😄

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...