All Apps and Add-ons

Is it possible to install and configure the Splunk Add-on for Amazon Web Services on a search head instead of a heavy forwarder?

caglar
New Member

I'm working on an existing Splunk environment where 1 Search Head and 2 Indexers are installed. Now I need to install the Splunk Add-on for Amazon Web Services. Should I install a heavy forwarder just for the AWS add-on? Or can I use Search Head which is not recommended and I'm getting this warning "Configuring this add-on on a search head is not best practice." What is the side effect of using Search Head for AWS add-on?

0 Karma
1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

Hi caglar, thanks for your question.

You can configure this add-on and collect your inputs on your search head, but doing so will impact your search performance. If you collect a very small amount of data with the add-on, this may not be a significant impact for you, but for best results, in a production environment, we strongly recommend that you configure inputs on forwarders, not on search heads.

This add-on requires heavy forwarders rather than universal forwarders because the configurations depend on Python and the setup and authentication are only supported using Splunk Web (neither of which comes with the universal forwarder.)

View solution in original post

rpille_splunk
Splunk Employee
Splunk Employee

Hi caglar, thanks for your question.

You can configure this add-on and collect your inputs on your search head, but doing so will impact your search performance. If you collect a very small amount of data with the add-on, this may not be a significant impact for you, but for best results, in a production environment, we strongly recommend that you configure inputs on forwarders, not on search heads.

This add-on requires heavy forwarders rather than universal forwarders because the configurations depend on Python and the setup and authentication are only supported using Splunk Web (neither of which comes with the universal forwarder.)

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...