DB Connect "DB Inputs" index

[tlmayes]

Hoping I can get some feedback on what others have done in this predicament.

Trying to deploy DB Connect 2.4.0 in a clustered SH / clustered IDX architecture to be used for "DB Inputs" only (no outputs, and lookups unlikely)

Per the Splunk docs, the app is deployed and configured first on a SH Manager/Deployer, and then deployed to the cluster members. All good so far and everything works including the connections.

Now trying to configure a DB Input. Get to the point in the GUI asking for the "index" and only the local indexes are available in the drop down (local to the search heads or SH Manager/Deployer). Expected the indexes on the "IDX Peers" to be presented. Waded through Splunk Answers. Several people talking about "deploy to a dedicated HF" or "deploy to the IDX Peers". The Splunk docs mention zip about anything other than deploying on SH's. Not a word about any other scenarios. All of our HF's are are headless (no GUI), and reluctant to put this directly on our Indexers. Don't mind "winging it", but am hoping for some lessons learned before going that route.

[adonio]

Hi tlmayes,
seems like there are couple of questions here. First, how can the app see all indexes that are on the Indexers? the answer is: place an indexes app with indexes.conf that matches your indexers indexes.conf (either an app or under _cluster folder) and deploy to search head cluster members.
Second, where is the best way to deploy the DB connect app? the answer to that is a Heavy Forwarder (HF). please read the docs here: http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/Architectureandperformanceconsiderations
and here:
http://docs.splunk.com/Documentation/DBX/2.4.0/DeployDBX/Architectureandperformanceconsiderations
lastly, you say your HF do not have GUI, can you verify these are HF and not UF?
if you would like to have all indexes options, again, place the indexes.conf with all indexes names on HF.

hope it helps