App and Add-on on separate machines

[sergiyyarinovsk]

Hi there.

I have an add-on which collects data. This add-on also has simple panel views. And I have separate app with dashboard. App's dashboard contains views from add-on. Everything works fine on same computer. Is it possible to move app and add-on on separate computers with access to the internet and make them work together somehow? 🙂
Splunk Enterprise latest version.

Thanks

[sergiyyarinovsk · Accepted solution]

Thanks for the quick response. Ok, I can move views to the app. But then:
1. How will application know where add-on index is?
2. Does it work with both cases: app and add-on on the same machine and separate?

[hardikJsheth]

1) Two different ways.
--> If you have indexer and search head on same node, just configure it to receive data.
--- >If you have three tier architecture, then configure it through indexer clustering.

2)Yes it works in both cases.

[hardikJsheth]

I aggree with answer from richgalloway. In Splunk, you can have a distributed architecture, where one node is data collection node known as forwarder. Forwarder sends data to Indexer node. Third one is a Search head node. All these are Splunk Enterprise Application working differently except Forwarder. Forwarder can be either full Splunk enterprise version or Splunk Universal Forwarder.

According to your requirement, you can keep one node as Forwarder (either heavy or universal forwarder) and second node which can work as Indexer as well as Search head node Install Add on the Forwarder and visualization app on Search head node.

[richgalloway]

Add-ons should not have views. They should collect data for indexing. All views should be in the separate app which gets its data from the index(es). Following this model allows for the app and add-on to be on separate servers and still function normally.