Agent management provisioning
When provisioning agent management, note the following:
- If it will be deploying to more than 50 agents, the agent management must run on a dedicated Splunk Enterprise instance. The instance cannot double as an indexer or search head.
- Do not host a distributed management console, which is essentially a search head, on an agent management with more than 50 agents.
- Do not host a search head cluster deployer on an agent management with more than 50 agents.
- If the agent management has less than 50 agents, you can co-locate the agent management on an indexer or search head, including a distributed management console.
- Because of high CPU and memory usage during the app download process, it is recommended that the instance reside on a dedicated host machine.