https://community.splunk.com/t5/Knowledge-Management/scripted-inputs-best-practices/m-p/262336#M7988 <P>What is the scripted input doing?</P> Mon, 28 Mar 2016 12:28:56 GMT dcarmack_splunk 2016-03-28T12:28:56Z https://community.splunk.com/t5/Knowledge-Management/scripted-inputs-best-practices/m-p/262334#M7986 <P>Are there any best practices regarding <EM>where</EM> a scripted input should run? Is there a benefit in using an intermediate forwarder to run really intensive scripted inputs?</P> Sat, 26 Mar 2016 23:33:43 GMT https://community.splunk.com/t5/Knowledge-Management/scripted-inputs-best-practices/m-p/262334#M7986 bfaber 2016-03-26T23:33:43Z https://community.splunk.com/t5/Knowledge-Management/scripted-inputs-best-practices/m-p/262335#M7987 <P>If the scripted input is really intensive, I would suggest it to run on Heavy forwarders. If ran on SH, it would consume user resources and if ran on Indexers, it's data would only be available on the indexer where it ran and would fail the purpose of distributed configuration.</P> Sun, 27 Mar 2016 17:52:47 GMT https://community.splunk.com/t5/Knowledge-Management/scripted-inputs-best-practices/m-p/262335#M7987 somesoni2 2016-03-27T17:52:47Z https://community.splunk.com/t5/Knowledge-Management/scripted-inputs-best-practices/m-p/262336#M7988 <P>What is the scripted input doing?</P> Mon, 28 Mar 2016 12:28:56 GMT https://community.splunk.com/t5/Knowledge-Management/scripted-inputs-best-practices/m-p/262336#M7988 dcarmack_splunk 2016-03-28T12:28:56Z