All Apps and Add-ons

Data Curator app does not show all dashboards. I need to install it on all indexers too?

sfmandmdev
Path Finder

Does the Data Curator app go on to all indexers too? I just installed it onto the deployer and search head cluster members. Does that not work?

0 Karma

Runals
Motivator

The app is designed to just be installed on a search head. I'm not sure how it would work in a SHC as we don't have one stood up here. There are some summary searches that run and don't know how the SHC would react to apps that have summary searches - does each SH run them? I'd assume so.

At any rate there are a couple reasons the app would/might not show data on certain panels. The first is there are some panels that rely on summary searches to have already run and some of those run just once a day. It is likely that some of the panels will have data today when they didn't yesterday. The second reason is, depending on dashboard/panel, the app assumes the props and transforms configuration files you are sending to your indexers is the same you are sending to your search heads. To that end the rest queries it makes are only looking at the local server. Many TAs are designed like this where index and search time settings are simply bundled together.

There are a number of ways a Splunk environment can be configured. In our case we have several stand alone search heads, moved from stand alone indexers to idx clustering, and are using a deployment server to push changes to our TAs. The TAs we build are per technology/log type and do not differentiate between stuff only applicable to indexers or search heads.

Hope some of that is helpful!

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...