topic Splunk_TA_Windows deployment on a Search Head in All Apps and Add-ons

Splunk_TA_Windows deployment on a Search Head

dersa — Wed, 26 Jul 2023 14:20:32 GMT

Hi, we have a distributed Splunk environment and I have successfully deployed the UF to Windows Server. I am getting data into my Indexer.

My question is regarding the Search Head cluster. I believe I need to deploy the TA also to the Search Heads to get properties from the props.conf and other files.

Do I need to deploy the complete TA to my Search heads or just specific files?

Thanks in advance

Alex

Re: Splunk_TA_Windows deployment on a Search Head

nniranjanreddy — Wed, 26 Jul 2023 14:40:34 GMT

Hi,

You can install Splunk_TA_Windows on search head by removing the inputs.conf file for managing KOs & other Search time functionalities.

Refer the below documentation:
https://docs.splunk.com/Documentation/AddOns/released/Windows/Install#Distributed_deployment_feature_compatibility

You can install this add-on on a search head cluster for all search-time functionality, but configure inputs on forwarders to avoid duplicate data collection.
Before you install this add-on to a cluster, make the following changes to the add-on package: Remove the inputs.conf file.

Re: Splunk_TA_Windows deployment on a Search Head

dersa — Wed, 26 Jul 2023 14:42:43 GMT

Thanks for the quick reply. I'll give it a try right now.

Re: Splunk_TA_Windows deployment on a Search Head

richgalloway — Wed, 26 Jul 2023 14:47:22 GMT

Deploy the complete TA with inputs disabled to your SH.

Re: Splunk_TA_Windows deployment on a Search Head

gcusello — Wed, 26 Jul 2023 15:29:47 GMT

Hi @dersa ,

I'm agree with @richgalloway : I don't like to customize add-ons, I always prefer to use standard add-ons, eventually disabling inputs, to avoid, for the updates, to remember the customizations you did and make them every time.

Ciao.

Giuseppe