Deployer

The deployer is used to to distribute apps and configuration files to the search head cluster, and when a search head that was down comes back up, it contacts the deployer to see if it has missed any updates. So, let's build that component before setting up the search heads.

Assuming you've configured the deployer to get its licensing from the license master and to forward internal logs to the indexers, there is only a minor configuration change to be made on the server.conf file in /opt/splunk/etc/system/local to prepare this node to be a deployer. These settings cannot be accomplished from Splunk Web:

[shclustering]
shcluster_label = DevTestSearchHeads
pass4SymmKey = !Sp1unkSH!

The shcluster_label entry is a label of your choice that identifies the search cluster in the Monitoring Console (covered in a later chapter). pass4SymmKey is entered in plain text, and Splunk will obfuscate this entry upon the next startup; this is the secret key the search head cluster members will use to communicate with the deployer and each other.