topic splunk distributed environment issues in Deployment Architecture

splunk distributed environment issues

elkhafif — Sat, 29 Feb 2020 18:40:55 GMT

I have some questions that i hope someone can help me clarifying them :
1) In an indexer cluster, can i install apps and add-ons on each indexer separatly without pushing all using the cluster master?

2)If i will use cluster master, should i untar the apps and add-ons that i put in /master-apps or no need for the unpacking step ?

3)how to use sendtoindexer app if i have an indexer cluster ?, I mean , what should be written in the text file exactly ?
thanks in advance

Re: splunk distributed environment issues

richgalloway — Sat, 29 Feb 2020 19:58:32 GMT

1) Yes, but why do that? Using the CM means not having to install apps on each indexer separately. It also avoids the potential conflict if the same app is both locally-installed and CM-installed.

2) Yes, untar the app in master-apps.

3) The sendtoindexer app is installed on forwarders. It should be placed your deployment servers's deployment-apps directory and deployed to the appropriate forwarders. The outputs.conf file will contain the addresses for your indexers. Alternatively, if you're using Indexer Discovery the file will contain the address of your cluster master.

Re: splunk distributed environment issues

elkhafif — Sat, 29 Feb 2020 20:03:09 GMT

could u please give me an example of the syntax written in the text if for example the ips of the indexers are 192.168.1.3/4 and the CM is .5 ?

Re: splunk distributed environment issues

woodcock — Sat, 29 Feb 2020 23:53:19 GMT

1: Yes, but then use this as your ONLY method of deploying configuration changes.
2: You should unpack them, but not by manually with tar. There is potentially MUCH more that happens when some complicated apps are installed (like SecKit* and SideView Utils) and you will BREAK the app if you just untar. Instead ALWAYS use $SPLUNK_HOME/bin/splunk install
3: That app should just have an outputs.conf file.

Re: splunk distributed environment issues

richgalloway — Sun, 01 Mar 2020 15:02:16 GMT

See https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Outputsconf