All Apps and Add-ons

How to configure REST API Modular Input with Search Head Cluster

burwell
SplunkTrust
SplunkTrust

I am using REST API Modular Input to sample Twitter per http://blogs.splunk.com/2014/07/03/splunking-social-media-tracking-tweets/ on a Standalone Search Head. It all works great.

How would I configure this on a search head cluster? Would I add inputs.conf on each Search Head in my cluster? How would we be sure each head didn't run the rest command but the results would be available across all heads.

The inputs.conf has the stanza

 [rest://TwitterFeed]
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

In a distributed architecture you should install the App on a Forwarder and edit inputs.conf directly rather than using the config UI.

View solution in original post

Damien_Dallimor
Ultra Champion

In a distributed architecture you should install the App on a Forwarder and edit inputs.conf directly rather than using the config UI.

matthewroberson
Path Finder

Is there a way to have high availability for the REST Modular Input(without resorting to a load balancer)? What if the standalone search head/forwarder goes down?

0 Karma

burwell
SplunkTrust
SplunkTrust

So I tried on a forwarder but was getting odd python errors. Does the REST API Modular Input have to be on a full Splunk install or will a splunk forwarder install suffice?

0 Karma

Damien_Dallimor
Ultra Champion

"...Unlike full Splunk Enterprise, the universal forwarder does not include a bundled version of Python...."

http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Typesofforwarders#The_universal_forward...

UF's need a python runtime on the OS.
Heavy Forwaders do not.

0 Karma

burwell
SplunkTrust
SplunkTrust

Thanks. So the problem was the default python was 2.6. Once I pointed /usr/bin/python 2.7 I got it to work. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...