Deploy in multi-tenant environments

Deploy in multi-tenant environments

A multi-tenant deployment server topology means that you have more than one deployment server running on the same Splunk instance, and each deployment server is serving content to its own set of deployment clients. (You can also achieve the same effect using two Splunk instances, each with its own configuration.)

Use tenants.conf to redirect incoming requests from deployment clients to another deployment server or servers. This is typically used for offloading load on your splunkd's HTTP server--having many deployment clients hitting the splunkd HTTP server at once to download Apps and configurations can overload the deployment server. Over 400 connections at one time has been shown to bog down splunkd's HTTP server, but this does not take into account your hardware or the size of the package the client is downloading--this will be constrained by your bandwidth size.

Note: There is typically no need to create/edit tenants.conf unless you have worked with Splunk Professional Services to design a custom deployment that includes explicit involvement of tenants.conf.

To set up multiple deployment servers on a single Splunk instance, you:

• Create a tenants.conf containing a whitelist or blacklist that tells deployment clients which deployment server instance to use.
• Create a separate instance of serviceclass.conf for each deployment server, named for that deployment server, like so: <tenantName>-serviceclass.conf.
• For each deployment client, configure deploymentclient.conf the way you would if there were just one deployment server.

What you can define in tenants.conf

You identify the different deployment servers as "tenants" in tenants.conf on the Splunk instance that will host these deployment servers. There isn't a tenants.conf file by default, so you will create one in $SPLUNK_HOME/etc/system/local and define the tenants in it.

For each tenant, create a stanza with the heading [tenant:<tenantName>], and specify the whitelist/blacklist filterType that deployment clients use to determine if this is the deployment server instance they should use.

filterType

<whitelist or blacklist>

• defaults to whitelist
• whitelist.<n> = <ipAddress or hostname or clientName>
• blacklist.<n> = <ipAddress of hostname of clientName>
  • 'n' is a number starting at 0, and increasing by 1. Stop looking at the filter when 'n' breaks.
  • ipAddress of deployment client. Can also use wildcards as 10.1.1.*
  • hostname of deployment client. Can also use wildcards as *.splunk.com.
  • clientName- a logical or 'tag' name that can be assigned to each deployment client in deploymentclient.conf. clientName takes precedence (over ip/hostname) when matching a client to a filter.

• Was this topic useful?
• Post a comment