Splunk® Enterprise

Updating Splunk Enterprise Instances

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Estimate deployment server performance

This topic can help you estimate how long it will take to download your apps to a set of clients. These are the key determining factors:

  • The deployment server specs
  • The phone home interval (that is, how frequently each client checks in with the deployment server for updates)
  • The number of clients
  • The total size of the apps

Deployment server provisioning

When provisioning a deployment server, note the following:

  • If it will be deploying to more than 50 clients, the deployment server must run on a dedicated Splunk Enterprise instance. The instance cannot double as an indexer or search head.
  • Do not host a distributed management console, which is essentially a search head, on a deployment server with more than 50 clients.
  • Do not host a search head cluster deployer on a deployment server with more than 50 clients.
  • If the deployment server has less than 50 clients, you can co-locate the deployment server on an indexer or search head, including a distributed management console.
  • Because of high CPU and memory usage during the app download process, it is recommended that the instance reside on a dedicated host machine.

Time to deploy on Linux

The guidance here is based on testing done using the following set-up:

  • A deployment server running on a dedicated bare metal 64-bit Linux system with 12GB RAM and 12 cores.
  • Deployment across a high-speed LAN network. On higher latency networks, the time to deploy will be longer.
  • A client phone home interval of 60 seconds.
  • A set of apps totaling 50MB in size. This is considered a relatively large size to deploy, because in most situations you would deploy a set of apps only once, followed by incremental updates.

To estimate the total time it will take to deploy 50MB to all your clients (assuming the deployment server hardware discussed above), you can use this formula: 

T = 0.0075 * C + 2

where T is the maximum time to deploy in minutes, and C is the number of deployment clients.

For example, it would take a maximum of 9.5 minutes to deploy 50MB of apps to 1000 clients.

Time to deploy on Windows

The guidance here is based on testing done using the following set-up:

  • A deployment server running on a dedicated 64-bit Windows Server 2008 virtual machine, with 12GB RAM and 8 cores.
  • Deployment across a high-speed LAN network. On higher latency networks, the time to deploy will be longer.
  • A client phone home interval of 60 seconds.
  • A set of apps totaling 50MB in size. This is considered a relatively large size to deploy, because in most situations you would deploy a set of apps only once, followed by incremental updates.

To estimate the total time it will take to deploy 50MB to all your clients (assuming the deployment server hardware discussed above), you can use this formula: 

T = 0.04 * C + 8

where T is the maximum time to deploy in minutes, and C is the number of deployment clients. This formula is valid for deployments up to 3000 clients.

If you are deploying to more than 2000 clients, you might experience significantly improved performance by increasing the phone home interval to five minutes (300 seconds).

Last modified on 24 May, 2023
View app deployment status   Use forwarder management to manage apps

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters