Agent management provisioning

When provisioning agent management, note the following:

  • If it will be deploying to more than 50 agents, the agent management must run on a dedicated Splunk Enterprise instance. The instance cannot double as an indexer or search head.
  • Do not host a distributed management console, which is essentially a search head, on an agent management with more than 50 agents.
  • Do not host a search head cluster deployer on an agent management with more than 50 agents.
  • If the agent management has less than 50 agents, you can co-locate the agent management on an indexer or search head, including a distributed management console.
  • Because of high CPU and memory usage during the app download process, it is recommended that the instance reside on a dedicated host machine.