Module 6: Forwarder Management

Question 1

A ___ is the tool for managing remote Splunk instances centrally.

Answer 1

deployment server

Question 2

___ is a graphical interface built on top of the deployment server

Answer 2

forwarder management

Question 3

Why use forwarder managment?

Answer 3

• Centralised – handle thousands of forwarders from one system
• Distribute configuration files
• Monitor the availability of forwarders and restart them remotely

Question 4

What is a Splunk deployment server?

Answer 4

• A tool to manage Splunk conf files
• Splunk Enterprise license is require
• Can be accessed via Splunk web
• Keep a dedicated server for deployment server
• Cannot be used for installing/upgrading forwarders

Question 5

What is a deployment app?

Answer 5

• Mechanism to distribute configuration files to forwarders
• App must adhere to standard app directory structure
• It can contain configuration files, scripts, views and other resource
• On the DS, apps are stored in $SPLUNK_HOME/etc/deployment-apps
• On the forwarders, apps will be deployed in $SPLUNK_HOME/etc/apps

Question 6

How do you set up a deployment server?

Answer 6

• Create at least one app in $SPLUNK_HOME/deployment-apps

* Forwarder management UI is not activated until a deployment app is found

Question 7

How do you set up a deployment client?

Answer 7

• Forwarders must be setup as deployment client
• Primary configuration file is deploymentclient.conf
• Can use command ./Splunk set deploy-poll :8089
• Deploymentclient.conf is located in $SPLUNK_HOME/etc/system/local

Question 8

Name the customisations of the deploymentclient.conf

Answer 8

• targerUri - Must be under [target-broker:deploymentServer] stanza. Specifies deployment server
• clientName – custom name that be used by DS in serverclass
• phoneHomeIntervalInSecs – how frequently the DS is checked for new content (default=60)

Question 9

What is a serverclass?

Answer 9

• Maps groups of clients to deployment apps
• Clients can be grouped based on client name, host name, IP address, DNS name or machine types
• Defined in serverclass.conf

Question 10

How do you create a serverclass?

Answer 10

• You can manually edit serverclass.conf or us Splunk Web
• Choose hosts to include (whitelist) and to exclude (blacklist)
• Assign one or two apps to the serverclass

Question 11

How do you monitor forwarders?

Answer 11

• Forwarding monitoring can be enabled from monitoring console (recommended)
• Periodically, using internal logs from the forwarders, a forwarder asset table (lookup) is built
• We can monitor
o Forwarder state (active/missing)
o Data throughput (kb/s)
o Events throughput (events/s)

Question 12

What is rebuilding the forwarder assets table and why is it used?

Answer 12

• Monitoring console will mark a forwarder as missing if it has not reported in the past 15 minutes
• To avoid decommissioned servers from being reported, you can rebuild the forwarder assets table
• This is a resource intensive process, so run it during off-peak hours
• Monitoring console > settings > forwarder monitoring setup > rebuild forwarder assets