We are looking for ways to pull REST API data into multiple Splunk indexers equally like the way Splunk forwarders forward data into indexers equally without duplicating. I'm able to pull on one indexer by installing and configuring REST API Modular Input but would like to do the same on all indexers without duplicating the data.
@spradeep - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.
Why not build either a heavy forwarder (Splunk enterprise installation used for forwarding data only) or universal forwarder to run the REST API modular inputs from?
It's the best way to ensure the data is balanced across all cluster members in the indexer cluster.
For REST API and any kind of HTTP event collector we use 2 heavy forwarders with a load balancer in front, these then balance the traffic across the indexer cluster to ensure the data is not unevenly spread...
