Configure Splunk deployment server

One of the most over looked areas in any Splunk environment is the use of a deployment server for forwarder management. The Splunk forwarder alone is a very powerful tool, however as you expand your use of Splunk you may find a need to modify the forwarder to accept and translate additional data. In many cases vendors may provide what are known as a Technology Add-on or TA for short to help with those needs. The add-ons are required in both your Splunk Search Head as well as your managed forwarders. The deployment server helps facilitate the deployment of the TA without having to manually touch each endpoint or server in your environment, or rely on third party tools.

Continue reading