Deployment Architecture

Can Search head members and deployer run on same lb

dhawal_sanghvi
New Member

Can the deployer and search head cluster members run on the same load balancer? I have a load balancer and the pool members behind the lb are search head members, captain. Can I have the deployer on the same load balancer or should I run independently outside lb?

Tags (1)
0 Karma
1 Solution

koshyk
Super Champion

Bit tricky, but my answer is it depends on your environment and risk factors

  1. Deployer is mainly for Splunk administrators but SH members for end-users. So the main query to ask yourself is why you need a load-balancer for Deployer?
  2. If you have so many Deployers (eg to manage multiple SH clusters), then better to configure a LB just for deployers
  3. In some of our client environments, the administrator systems are in different security context and accessible only for administrators similar to Cluster Master and deployment-server, but SH members are exposed to more employees like Customer Support. So better to have segregation so no one meddles with your admin systems

Using all the above analogy , my suggestion is to have SH-members in LB and Deployer to run separately.

View solution in original post

0 Karma

dhawal_sanghvi
New Member

Thanks for all the inputs. I will have the deployer out of the LB as a stand alone Splunk server.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dhawal_sanghvi,
why you need to put your Deployer on Load Balancer?
Deployer is a single server (so it doesn't need LB) dedicated to manage Search Head Cluster and usually isn't accessed by users, but only by administrators.
Bye.
Giuseppe

0 Karma

koshyk
Super Champion

Bit tricky, but my answer is it depends on your environment and risk factors

  1. Deployer is mainly for Splunk administrators but SH members for end-users. So the main query to ask yourself is why you need a load-balancer for Deployer?
  2. If you have so many Deployers (eg to manage multiple SH clusters), then better to configure a LB just for deployers
  3. In some of our client environments, the administrator systems are in different security context and accessible only for administrators similar to Cluster Master and deployment-server, but SH members are exposed to more employees like Customer Support. So better to have segregation so no one meddles with your admin systems

Using all the above analogy , my suggestion is to have SH-members in LB and Deployer to run separately.

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...