Agent management repository modes

Choose between two repository modes, ds and database, to control how agent management reads supported data in your environment.

Choose between two repository modes, ds and database, to control how agent management reads supported data in your environment.

You configure the repository mode with repository_type in agent_management.conf.

Repository type Behavior Additional configuration
ds Reads supported data directly from the agent management index data. This is the default and recommended repository type. None.
database Uses a Postgres-backed repository that Agent Management populates and queries. Advanced configuration for Splunk Enterprise 10.4. Requires you to activate and schedule the SplunkDeploymentServerConfig saved-search pipeline.

ds mode is the default operational mode. You can use database mode to reduce direct-read pressure on agent management for supported flows, but in Splunk Enterprise 10.4 you must manually activate it, validate operations, and carefully configure forwarding and indexing.

Operational characteristics

When you use the Postgres-backed repository mode, the data that agent management serves depends on saved-search output, background ingestion, and client-matching refresh cadence. Consider the following characteristics before you activate database mode:

  • database mode is an advanced configuration in Splunk Enterprise 10.4. Use it only when you can validate the saved-search pipeline, CSV ingestion, Postgres availability, and data freshness in your environment.
  • Not every internal agent management data path uses the Postgres-backed repository.
  • Data freshness depends on the saved-search pipeline, background ingestion pipeline, and client-matching refresh cycle.
  • After you change an agent management configuration, such as server classes or applications, the first agent management UI or API load that depends on client matching can take longer. Agent management recalculates and stores database-backed client-matching data once for the new configuration state. After recalculation completes, later UI loads reuse the refreshed data until the next configuration change.
  • If ingestion falls behind, newer data can take longer to appear in agent management.
  • Overall scale depends on the capacity of your Splunk search tier, agent management, and Postgres.
  • Higher throughput settings can improve processing rate but can also increase pressure on agent management and Postgres.

Data pipeline

The Postgres-backed repository mode uses saved searches in the SplunkDeploymentServerConfig app to gather agent management data from _internal, write CSV lookup batches, and prepare those batches for ingestion.

The pipeline uses these saved searches:

  • AgentManagerAppEventData
  • AgentManagerPhonehomeData
  • AgentManagerClientData
  • AgentManagerEventSummary

The saved searches are inactive and not scheduled by default. When you configure database mode, you must activate the saved-search pipeline.

AgentManagerAppEventData, AgentManagerPhonehomeData, and AgentManagerClientData are producer searches that generate per-minute CSV batches for application events, phonehome data, and client metadata. You must activate and schedule all three.

AgentManagerEventSummary identifies the CSV batches that are ready for ingestion. You must activate it, but it does not need scheduling because the ingestion flow uses it directly.

Agent management ingests the resulting batches into Postgres and refreshes database-backed matching data.