Splunk Components | universal forwarder | Heavy forwarder

Summary

This video introduces key components of Splunk, focusing on the Universal Forwarder and Enterprise software packages. It explains the roles of Heavy Forwarder, Indexer, Search Head, and Deployment Server, highlighting the importance of event parsing and filtering to optimize data indexing. The script also covers the architecture of a Splunk deployment, including the functions of the Cluster Master and License Master, and the significance of the Deployment Server in managing configurations across the system.

Takeaways

• 📚 The video introduces Splunk components and its two main software packages: Splunk Universal Forwarder and Splunk Enterprise.
• 🔄 Splunk Enterprise can perform various roles including Heavy Forwarder, Indexer, Search Head, Deployment Server, Cluster Master, and License Master.
• 🌐 Splunk Universal Forwarder (UF) is a separate, free software package that collects events from servers or endpoints without requiring a license.
• 🔍 UF is used for scenarios like monitoring continuously updated files or NTP service synchronization and can be managed by a Deployment Server.
• 🚫 UF cannot parse events, which involves breaking data into blocks, identifying timestamps, and adding meta fields like source and host.
• 🔑 Heavy Forwarder (HF) is a role of Splunk Enterprise that can parse events and apply filters to remove unwanted data, thus saving on Splunk licensing costs.
• 📈 The need for HF is recommended in larger deployments to offload the indexer's workload and improve performance.
• 🗂️ Splunk Indexer stores, indexes, and serves event data to the Search Head, which is crucial for handling search queries and generating reports.
• 🔑 Splunk Cluster Master manages the indexer cluster, including data replication and adjusting cluster buckets in case of peer node failure.
• 🔍 The Search Head is the interface for non-admin users to interact with Splunk, allowing them to run queries, generate reports, and create knowledge objects.
• 🛠️ Splunk Deployment Server acts as a centralized configuration manager, deploying updates to other instances and managing deployment clients.
• 🏢 Server Classes in Splunk are combinations of Deployment Clients and Deployment Apps, allowing for targeted configuration updates.
• 🛡️ Splunk License Master controls access to licenses for one or more license slaves, managing licensing volume and defining stacks and pools.

Q & A

What are the two main Splunk software packages mentioned in the video?

The two main Splunk software packages mentioned are Splunk Universal Forwarder and Splunk Enterprise.

What is Splunk Universal Forwarder (UF) and what is its purpose?

Splunk Universal Forwarder (UF) is a separate software package used for collecting events from servers or endpoints. It is free to download and does not require a license.

Can Splunk UF parse events?

No, Splunk UF is not capable of parsing events. Event parsing, which includes breaking data into blocks, identifying timestamps, and adding meta fields, is a capability of the Heavy Forwarder or Indexer.

What is the role of the Heavy Forwarder (HF) in Splunk Enterprise?

The Heavy Forwarder (HF) is an optional component of Splunk Enterprise that can parse and filter events, offloading some of the workload from the indexer and potentially saving on Splunk license costs.

How does the Deployment Server in Splunk Enterprise manage configurations?

The Deployment Server in Splunk Enterprise acts as a centralized configuration manager, deploying configuration updates to other instances, including Universal Forwarders and Heavy Forwarders.

What is an indexer in the context of Splunk Enterprise?

An indexer in Splunk Enterprise is responsible for storing, indexing, and serving the events to the search head. It is also referred to as a search peer if it is part of an indexer or cluster.

What is the function of the Cluster Master in a Splunk Enterprise setup?

The Cluster Master in Splunk Enterprise manages the indexer cluster, instructing where to stream replica data and adjusting cluster buckets. It also coordinates search head requests to the appropriate indexers.

What is the role of the Search Head in Splunk Enterprise?

The Search Head in Splunk Enterprise is the component that users interact with to run queries, generate reports, searches, dashboards, and create knowledge objects such as field aliases, calculated fields, lookups, event types, and tags.

What is the purpose of the Search Head Deployer in Splunk Enterprise?

The Search Head Deployer in Splunk Enterprise is used to deploy apps to the search head members of a cluster. It is recommended to use the Search Head Deployer instead of installing apps directly on search members.

What is a Deployment App and how does it relate to Server Classes in Splunk Enterprise?

A Deployment App is a unit of content deployed to the members of one or more server classes. A server class is a combination of deployment clients and deployment apps, allowing for the centralized management of configurations across similar systems.

What is the License Master role in Splunk Enterprise and how does it interact with License Slaves?

The License Master in Splunk Enterprise controls one or more License Slaves, providing them access to Splunk Enterprise licenses and managing the licensing volume. It allows for the definition of stacks, pools, and management of license slaves.