Splunk® Enterprise

Distributed Deployment Manual

Download manual as PDF

Download topic as PDF

Components that help to manage your deployment

Management components support the activities of the processing components. As with processing components, management components are specially configured versions of Splunk Enterprise instances.

Types of management components

A deployment usually includes one or more of these management components:

  • The deployment server updates configurations and distributes apps to processing components, primarily forwarders.

Whether to colocate management components

Depending on the component and its workload, you might be able to combine two management components on a single Splunk Enterprise instance. In some cases, you can locate a management component on an instance with a processing component.

In some low-use situations, you might be able to combine more than two management components on a single instance, although it is not generally recommended that you do so. If you intend to do so, monitor the performance impacts closely to ensure that you are not overloading the instance.

The following table summarizes the colocation possibilities, under ideal circumstances, for each management component type. Be sure also to read the disclaimer that follows the table, as it contains important guidelines on how to use the table.

Key: "LM" = license master; "MC" = monitoring console; "DS" = deployment server; "CM" = cluster master.

Management component Colocate with
LM? MC? DS? CM? Deployer? Indexer? Search head?
License master - yes yes yes yes yes yes
Monitoring console yes - yes yes yes no yes
Deployment server yes yes - no yes yes yes
Indexer cluster master node yes yes no - yes no no
Search head cluster deployer yes yes yes yes - no no

Do not use this table without further study of each component type. Some combinations are valid only within limited constraints.

Whether any two components in your deployment can actually be colocated depends on a number of factors, including the overall load on each component and your specific deployment topology. For that reason, you must read the colocation documentation for each component and follow the guidelines in that documentation.

In particular, both the deployment server and the cluster master have strict resource limits. If you exceed those limits, you cannot colocate any other component type with either of them.

For more information on colocating a specific management component, see the documentation for that component:

Components and the data pipeline
Key manuals for a distributed deployment

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters