topic Re: Why do we install apps on a Heavy forwarder through a deployment server? in Getting Data In

Why do we install apps on a Heavy forwarder through a deployment server?

riqbal — Sun, 24 Jun 2018 10:36:02 GMT

Hi everyone,

I am confused about deployment server function. can anyone elaborate it in simple words,
secondly why we need to install apps on heavy forwarders.

Re: Why do we install apps on a Heavy forwarder through a deployment server?

ddrillic — Mon, 25 Jun 2018 00:53:18 GMT

Magnificent centralized configuration mechanism ; -)

Re: Why do we install apps on a Heavy forwarder through a deployment server?

ritureddy — Mon, 25 Jun 2018 04:25:35 GMT

heavy forwarder is intermediate component between universal and indexer components. its eliminate the garbage data and its do index routing, masking the data and sourcetype routing before going to indexer. for this purpose we have to use props.conf and transforms.conf files.

in transforms.conf we have to set the rules and in props.conf what is rule and to whom to apply.

Re: Why do we install apps on a Heavy forwarder through a deployment server?

sc31656us — Fri, 02 Nov 2018 02:14:22 GMT

The deployment server is used to deploy configuration files (like inputs.conf or props and transforms...) / TA's / Apps to end points that have a universal forwarder on them. It allows you to push config changes to all your end points without having to do it manually one by one.

There are some apps that require the python libraries that come with a HF. This is why some apps may require the use of a Heavy Forwarder.

Types of forwarders: http://docs.splunk.com/Documentation/Splunk/7.2.0/Forwarding/Typesofforwarders