Deployment Architecture

Deployment server strategies

sanju005ind
Communicator

I have about 800 forwarders, 3 indexers and a search head.The indexers are in Asia,Europe and Americas. I would like to have a Deployment server to deploy several standard forwarders and also have consistent configuration files across all 3 indexers. I am thinking of having a single dedicated Deployment server and have various sever classes. Indexer class- For having similiar configuration and Apps, Windows_Forwarder class for windows forwarders and Linux_Forwarder class for the Linux forwarders.

Is a single deployment server enough or do I have to go for multiple Deployment servers? Can I use Single Deployment server to manage Forwarders and the 3 indexers?

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

A single Deployment Server will be fine. I would set my deployment client phone home interval to about 10 minutes (600 seconds), which means you'll only be getting one or two requests per second in total from all clients on your DS. If you like, you can have the indexers check in a little more frequently.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

A single Deployment Server will be fine. I would set my deployment client phone home interval to about 10 minutes (600 seconds), which means you'll only be getting one or two requests per second in total from all clients on your DS. If you like, you can have the indexers check in a little more frequently.

sdwilkerson
Contributor

gfriedmann
Any app dir should work (taking into account precedence). Just to be clear, you set the value in "seconds" and not "minutes," correct?

0 Karma

gfriedmann
Communicator

I am having trouble getting this setting to implement. Using a universal forwarder on windows the default checkin seems to be 60 seconds. I tried to specify 5 minutes in /apps/foo/local/deploymentclient.conf , but it still checks in every 60 seconds.

Do you know if this must be set in system/local/deploymentclient.conf , or is it expected to work if specified in any /etc/app/ directory?

0 Karma

tomasmoser
Contributor

Any config file under system/local/configfile.conf will take precedence over etc/apps/appX/configfile.conf. You mentioned windows agent. If you specify target url for deployment server when installing UF client via GUI manually or through silent installation (parameters) this config will always end up in system/local. So if you want to updated this with deployment server which will deploy any app to etc/app/appX it will NOT work. You need to get rid of system/local configuration.

Usually this is done this way:
1. install deploymentclient.conf via special configuration app from DS into etc/app/deploymentclient.conf.
2. install similar app that will run a script that will DELETE corresponding etc/system/deploymentclient.conf with restarting UF checked in DS.

0 Karma

sanju005ind
Communicator

Thanks a lot kanapathy.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...