Deployment Architecture

Deployment server strategies

sanju005ind
Communicator

I have about 800 forwarders, 3 indexers and a search head.The indexers are in Asia,Europe and Americas. I would like to have a Deployment server to deploy several standard forwarders and also have consistent configuration files across all 3 indexers. I am thinking of having a single dedicated Deployment server and have various sever classes. Indexer class- For having similiar configuration and Apps, Windows_Forwarder class for windows forwarders and Linux_Forwarder class for the Linux forwarders.

Is a single deployment server enough or do I have to go for multiple Deployment servers? Can I use Single Deployment server to manage Forwarders and the 3 indexers?

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

A single Deployment Server will be fine. I would set my deployment client phone home interval to about 10 minutes (600 seconds), which means you'll only be getting one or two requests per second in total from all clients on your DS. If you like, you can have the indexers check in a little more frequently.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

A single Deployment Server will be fine. I would set my deployment client phone home interval to about 10 minutes (600 seconds), which means you'll only be getting one or two requests per second in total from all clients on your DS. If you like, you can have the indexers check in a little more frequently.

sdwilkerson
Contributor

gfriedmann
Any app dir should work (taking into account precedence). Just to be clear, you set the value in "seconds" and not "minutes," correct?

0 Karma

gfriedmann
Communicator

I am having trouble getting this setting to implement. Using a universal forwarder on windows the default checkin seems to be 60 seconds. I tried to specify 5 minutes in /apps/foo/local/deploymentclient.conf , but it still checks in every 60 seconds.

Do you know if this must be set in system/local/deploymentclient.conf , or is it expected to work if specified in any /etc/app/ directory?

0 Karma

tomasmoser
Contributor

Any config file under system/local/configfile.conf will take precedence over etc/apps/appX/configfile.conf. You mentioned windows agent. If you specify target url for deployment server when installing UF client via GUI manually or through silent installation (parameters) this config will always end up in system/local. So if you want to updated this with deployment server which will deploy any app to etc/app/appX it will NOT work. You need to get rid of system/local configuration.

Usually this is done this way:
1. install deploymentclient.conf via special configuration app from DS into etc/app/deploymentclient.conf.
2. install similar app that will run a script that will DELETE corresponding etc/system/deploymentclient.conf with restarting UF checked in DS.

0 Karma

sanju005ind
Communicator

Thanks a lot kanapathy.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...