Deployment Architecture

how do you create a scalable splunk deployment of forwarders to specific index servers that report to a search head?

HenryTaylor
Explorer

how do you create a scalable splunk deployment of forwarders to specific index servers that report to a search head?

Tags (2)
0 Karma

Runals
Motivator

I'd say use a deployment server and create multiple copies of outputs.conf as appropriate in your environment. At a high level a client checks into the deployment server, the appropriate outputs.conf package gets pushed, the forwarder restarts and starts sending logs to the right indexer(s). The kicker is to figure out how best to identify which hosts should get which outputs.conf. Can use things like hostnames, IP addresses, or what I like best to use is the clientName setting on the local forwarder agent. At any rate once you have those things in place new agents can come online and once they have checked into your deployment center it is all automagic.

The guts of how to do this are in the link martin posted but sometimes it is tough looking at documentation and thinking about it in terms of your environment.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There's plenty of info here: http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Distributedoverview

If you have specific questions after that feel free to ask 🙂

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...