Introducing DS Management App: A Faster Alternative to Splunk Forwarder/Agent Management

DS Management App

Introducing DS Management App: A Faster Alternative to Splunk Forwarder/Agent Management

🚀 Data Elicit Solutions Open Sources  Splunk DS Management App: Easily Manage More Than 10,000 Clients

Why We Made the Splunk DS Management App

The Deployment Server (DS) from Splunk is a great way to keep track of setups and apps on all of your forwarders.  But when Splunk Deployment Server have more over 5,000 deployment clients, they generally run into performance problems. Some common problems are:

  • Slow Deployment Server UI.
  • Pushes for apps and add-ons are taking longer.
  • To reduce load, polling intervals must be raised from the default of 60 seconds to 5–10 minutes.


We at Data Elicit Solutions wanted to get around these problems by designing a more flexible solution: the Splunk DS Management App.  What Sets It Apart? The DS Management App uses Splunk functionality like custom Splunk REST Endpoints and Splunk static endpoints and is designed to work quickly.  This app can do things that the normal Deployment Server can’t:

High Scalability: Manage more than 10,000 deployment clients with a polling interval of 60 seconds
Responsive UI: Make sure the UI is responsive and stays smooth even when there are thousands of servers. Give users an easy-to-use dashboard to control server classes and deployment apps.
Migration built in: Make it easier to migrate apps and serverclass. conf
Testing Support: Set aside some deployment clients for restricted rollouts
Resolve duplicate GUID issue

This makes it a great open-source replacement for Splunk Deployment Server for businesses that want to expand their observability infrastructure. 

How it works

  1. DS Management App contains:
    • Custom Rest Endpoint
    • Static files for each Deployment Client
  2. Add-on on Deployment Clients
    • It will try to fetch static file based on GUID, IP, Hostname, Deployment Client Name. If the file is not found, the script requests the list from a REST API, which generates the file and stores it for future use on the deployment server.
    • Upon receiving the application list (including checksums), the script compares it with the local state. If differences are detected, the script installs new applications, uninstalls removed ones, updates changed applications, and restarts the Splunk service as needed.
    • If no changes are found, no action is taken. The script includes retry logic for API failures and logs errors if all retries fail. This cycle repeats every 60 seconds.

Get the Source Code

We are happy to make this project open source under the AGPL License.  Check out the whole source code.

GitHub Repository

How to Get Started

  1. Put the DS Management App on your Splunk Deployment Server.
  2. Add your Deployment server IP/DNS, repository location, and phone-home interval to the app’s settings.
  3. Use the Migration Page to move apps and server classes.
  4. Use the Forwarder Management UI to manage deployment clients.

Contribute and Collaborate

We believe in development that is led by the community.  We invite the Splunk community to:

  • Add improvements
  • Tell us about bugs and problems
  • Give feedback and ask for new features

Help and Services

If you need help with technical issues or want to talk about features, please email us at: 📧 splunk.support@dataelicit.com

Our goal at Data Elicit Solutions is to provide solutions that make it easier to monitor and observe businesses.  The Splunk DS Management App helps us fix one of the major problems with Splunk administration that is getting the Deployment Server to work with more deployment clients than it was designed for.

We can’t wait to see how the community uses and builds on this solution. 🚀  Give it a try today:  GitHub has the Splunk DS Management App.

Need help with developing, customizing, or using Splunk apps or add-ons for your business? 👉 Email us at contactus@dataelicit.com, we’d be pleased to help.

Related Articles

Scroll to Top