All Apps and Add-ons

Data Curator app does not show all dashboards. I need to install it on all indexers too?

Path Finder

Does the Data Curator app go on to all indexers too? I just installed it onto the deployer and search head cluster members. Does that not work?

0 Karma


The app is designed to just be installed on a search head. I'm not sure how it would work in a SHC as we don't have one stood up here. There are some summary searches that run and don't know how the SHC would react to apps that have summary searches - does each SH run them? I'd assume so.

At any rate there are a couple reasons the app would/might not show data on certain panels. The first is there are some panels that rely on summary searches to have already run and some of those run just once a day. It is likely that some of the panels will have data today when they didn't yesterday. The second reason is, depending on dashboard/panel, the app assumes the props and transforms configuration files you are sending to your indexers is the same you are sending to your search heads. To that end the rest queries it makes are only looking at the local server. Many TAs are designed like this where index and search time settings are simply bundled together.

There are a number of ways a Splunk environment can be configured. In our case we have several stand alone search heads, moved from stand alone indexers to idx clustering, and are using a deployment server to push changes to our TAs. The TAs we build are per technology/log type and do not differentiate between stuff only applicable to indexers or search heads.

Hope some of that is helpful!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...