topic Where should I create custom app. on search head or app server (indexer) ? in Splunk Dev

Where should I create custom app. on search head or app server (indexer) ?

patelmc — Thu, 08 Aug 2019 15:28:07 GMT

I am not using deployment server in our environment yet. I have non-clustered search head and three indexers. If I want to create custom app where should I create it. on search head server or app server (indexer)?

I have same setup in A side (primary) and B side (standby). Both active - active.
A side - one search head and three app servers (indexers).
B side - one search head and three app servers (indexers).

I know this will consume double license but that's the requirement.

Re: Where should I create custom app. on search head or app server (indexer) ?

nareshinsvu — Fri, 09 Aug 2019 04:28:27 GMT

What is this new app used for? Usually apps sit on Search head layer

Refer this link for examples/process - http://dev.splunk.com/view/quickstart/SP-CAAAFDC

Re: Where should I create custom app. on search head or app server (indexer) ?

nareshinsvu — Mon, 12 Aug 2019 02:00:27 GMT

Is your issue resolved? kindly accept and/or upvote my response if it helped

Re: Where should I create custom app. on search head or app server (indexer) ?

patelmc — Mon, 12 Aug 2019 13:34:56 GMT

Thanks for the link which is very helpful. However, it does not provide answer I was looking for,
If I create new app or dashboard, whether I should create it on search head or indexer server itself?
If I create app or dashboard on search head, does it propagate that to the indexers automatic or I have to copy files manually from search head to indexer.
I am just thinking about syncing apps, dashboards, custom fields etc. etc. between search head and indexers.
I believe by default it does not get sync in between.
I created custom fields on search head for one type of data and created custom fields on indexer for second type of data.
When I looked into both search head and indexers, custom fields were missing on server other than where it was created.
So, I had to modify props.conf and transforms.conf manually so that it appears on other servers as well.

Is this the method I need to adopt or it can be achieved using some configuration level on search head and/or indexers?

Re: Where should I create custom app. on search head or app server (indexer) ?

nareshinsvu — Thu, 15 Aug 2019 01:19:57 GMT

Recommendation is to restrict apps/dashboards to search heads.
And leave indexers to only receive data from forwarders and store indexes.

If you can read your index data from search heads, dashboards/apps can be created only at the search layer.

Users should be restricted to only search heads where your dashboards reside. This way, the indexed data would be safe/untouched at the indexer layer.