topic Re: REST Inputs in cluster architecture in Getting Data In

REST Inputs in cluster architecture

mudragada — Fri, 03 Feb 2017 04:57:55 GMT

Hi,

I have a Splunk Heavy Forwarder, Indexer master and two Indexer slaves, two search heads in the current architecture.
I have few rest inputs within the network (a firewall away) to get the values in.

Now, I need to choose the machine on which the rest_ta app can be installed and define the rest inputs, to an existing index.

By practice/convention, where should the rest_ta app be installed and the inputs defined?

Re: REST Inputs in cluster architecture

adonio — Fri, 24 Feb 2017 16:46:33 GMT

Hi mudragada,
the Heavy Forwarder is probably your best bet here. the inputs will be defined from the GUI - settings (top right corner) -> Data inputs -> REST

Re: REST Inputs in cluster architecture

mudragada — Wed, 01 Mar 2017 04:22:13 GMT

I have about 700 rest inputs - which I need to define in a conf file. When I did via the UI, they're going into apps/search/local/inputs.conf. Is there a way we can define the inputs in a different file or folder, other than the ones that are defined already in the search app?

Re: REST Inputs in cluster architecture

adonio — Wed, 01 Mar 2017 14:40:10 GMT

there are many rest inputs packaged ni prebuilt apps, AWS and SalesForce are just an example link here: https://splunkbase.splunk.com/app/1274/ and are free to download at splunkbase. you can package rest inputs in apps of your choice.

Re: REST Inputs in cluster architecture

mudragada — Wed, 01 Mar 2017 15:34:49 GMT

The REST end points are internal to my network and REST Modular input is what I chose to enable them in Splunk to gather data. AWS app or SalesForce app may not help the situation.

Re: REST Inputs in cluster architecture

adonio — Wed, 01 Mar 2017 15:38:04 GMT

sure, it was just an example, so you can follow the inputs structure.
to your question, yes you can configure in different apps, therefore separate folder
hope it helps

Re: REST Inputs in cluster architecture

mudragada — Fri, 10 Mar 2017 06:03:25 GMT

Figured this one out. As stated in http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings, REST TA app needs to be installed on all HeavyForwarders - and the deployment-app should be used in HeavyForwarder configuration.