Splunk DFS Manager

[Note: Splunk Data Fabric Search (DFS) is no longer available for purchase as of May 20, 2020. Splunk Enterprise 8.x customers may continue to use the free version of Splunk DFS included with their Enterprise license. Version 1.1 is the final release of Splunk DFS, and version 1.2 is the final release of the accompanying Splunk DFS Manager app. There will be no additional major or minor releases of either product. Splunk DFS 1.1 and the Splunk DFS Manager app 1.2 will be supported until the October 22, 2021 end-of-support date of Splunk DFS 1.1. See the Splunk Software Support Policy for details.] The Splunk DFS Manager app enables you to run Data Fabric Search (DFS). The app automatically bundles, installs, and configures Apache Spark that is required for DFS. Additionally, the app helps you to continuously and seamlessly manage, configure, and monitor your Spark cluster and customize the resource allocation within your DFS deployment from any search head through a scalable and adaptive user interface to run a DFS search. Splunk DFS Manager installation and configuration: 1) Decide how many workers are required. 2) Provision nodes to run as workers. 3) Add the nodes as distributed search peers to the search head. 4) Install the app on the search head and search peers. - For indexers in an indexer cluster: Install the app using a cluster master. - For search heads in a search head cluster:Install the app using a search head cluster deployer. 5) DFSmaster automatically starts on the search head (in standalone mode) and on the search head captain in a search head cluster. 6) Access the Splunk DFS manager UI on the search head that runs as the DFS master. 7) Add the provisioned search peers as the DFS workers. 8) Run a DFS search. Splunk DFS Manager capabilities: - High availability that allows an alternate search head captain to restart the Spark master, in case the search head captain fails. - Customize resource usage by leveraging workload management (WLM) to allocate CPU and memory. - Add DFS workers on all or selected search peers. - Remove a DFS worker. - Restrict adding DFS workers to a particular site in a multi-site environment. - Monitor the health and resource usage of the Spark cluster. - Enable Spark security.