topic Re: Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)? in All Apps and Add-ons

Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

Koko12345678 — Sun, 22 Jul 2018 15:36:58 GMT

HI ,

I would like to know where should I install the Azure Monitor Add-on For Splunk? on which of this component? Heavy forwarder, indexer , Search head?

Thanks

Re: Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

thambisetty — Sun, 22 Jul 2018 15:46:36 GMT

Hi,

Better to install on HF.

Because INDEXER IS BUSY IN indexing data.
Search head is busy in searching.

Re: Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

Koko12345678 — Sun, 22 Jul 2018 15:53:03 GMT

as far as I know HF is busy in parsing the data,then I'm just asking myself why HF is the better place?
in addition, where Should I configure the Inputs( input for Activity Logs/Diagnostics Logs) in splunk? is it in the search head?

Re: Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

thambisetty — Sun, 22 Jul 2018 17:35:22 GMT

Its fully dependent on your environment.

In my case we have search heads loaded with so many scheduled searches so I could not allocate even 1 cpu for modular/scripted inputs and we have Indexers are busy in responding to searches and indexing data. Thats y I recommend to have modular inputs on HF.

Re: Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

Koko12345678 — Sun, 22 Jul 2018 17:38:24 GMT

ok thanks 🙂

Re: Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

adonio — Sun, 22 Jul 2018 18:14:06 GMT

Hello there,

ideally on the Heavy Forwarder, if not in the Search Head.
Avoid installing on indexer (unless its all in one)

hope it helps

Re: Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

Koko12345678 — Sun, 22 Jul 2018 20:09:44 GMT

thanks 🙂
can you please explain why it's Ideally to install it on the HF ? and why to avoid installing it on the Indexer? and what do you mean by "unless its all in one"?

thank you