topic Re: Will index cluster replicate data from script inputs? in Splunk Enterprise

Will index cluster replicate data from script inputs?

Haleb — Tue, 04 Jun 2024 19:53:34 GMT

Hi, I just installed a index cluster and i already know that i shoud place Apps to $SPLUNK_HOME/etc/master-apps/ directoty at my manager node to distribute it accross all indexers but i have 2 questions.

1. If an app that I deployed on the indexers uses Python scripts to fetch data, will this data be duplicated?
2. Do I need to prepare an app before deploying it to my indexers (remove unnecessary dashboards, eventtypes, etc)? Or can i leave it without changes?

Re: Will index cluster replicate data from script inputs?

richgalloway — Tue, 04 Jun 2024 20:08:23 GMT

1. Yes. Such apps should be installed on a heavy forwarder.

2. Some preparation may be necessary, depending on the app. Inputs.conf should be removed or all inputs disabled, for example.

Re: Will index cluster replicate data from script inputs?

Haleb — Tue, 04 Jun 2024 20:49:04 GMT

Thanks for your reply.
I notice that almost every app uses script inputs (e.g., Splunk Add-on for Amazon Web Services, Splunk Add-on for Google Workspace, etc.). In what cases do I need to distribute the app to my indexers?

Re: Will index cluster replicate data from script inputs?

richgalloway — Tue, 04 Jun 2024 23:14:45 GMT

If the app is installed on a heavy forwarder then all parsing is done there using the configurations in the app. There is little need for the app also to be on the indexers unless you like to wear suspenders (braces) with your belt.

P.S. I challenge the notion that almost every app uses script inputs. Of the thousands of app in splunkbase, comparatively few use input scripts. 🙂

Re: Will index cluster replicate data from script inputs?

Haleb — Wed, 05 Jun 2024 08:55:12 GMT

I have one more question. Can I use one Heavy Forwarder for all apps with script inputs, or would it be better to deploy a separate instance for every app?

Thanks for your help!

Re: Will index cluster replicate data from script inputs?

richgalloway — Wed, 05 Jun 2024 12:24:25 GMT

Generally speaking, yes, you can use a single HF for all of your input scripts. If you will be processing a lot of data then you may need an additional HF.