All Apps and Add-ons

Is it possible to install and configure the Splunk Add-on for Amazon Web Services on a search head instead of a heavy forwarder?

New Member

I'm working on an existing Splunk environment where 1 Search Head and 2 Indexers are installed. Now I need to install the Splunk Add-on for Amazon Web Services. Should I install a heavy forwarder just for the AWS add-on? Or can I use Search Head which is not recommended and I'm getting this warning "Configuring this add-on on a search head is not best practice." What is the side effect of using Search Head for AWS add-on?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi caglar, thanks for your question.

You can configure this add-on and collect your inputs on your search head, but doing so will impact your search performance. If you collect a very small amount of data with the add-on, this may not be a significant impact for you, but for best results, in a production environment, we strongly recommend that you configure inputs on forwarders, not on search heads.

This add-on requires heavy forwarders rather than universal forwarders because the configurations depend on Python and the setup and authentication are only supported using Splunk Web (neither of which comes with the universal forwarder.)

View solution in original post

Splunk Employee
Splunk Employee

Hi caglar, thanks for your question.

You can configure this add-on and collect your inputs on your search head, but doing so will impact your search performance. If you collect a very small amount of data with the add-on, this may not be a significant impact for you, but for best results, in a production environment, we strongly recommend that you configure inputs on forwarders, not on search heads.

This add-on requires heavy forwarders rather than universal forwarders because the configurations depend on Python and the setup and authentication are only supported using Splunk Web (neither of which comes with the universal forwarder.)

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!