All Apps and Add-ons

Is it possible to install and configure the Splunk Add-on for Amazon Web Services on a search head instead of a heavy forwarder?

caglar
New Member

I'm working on an existing Splunk environment where 1 Search Head and 2 Indexers are installed. Now I need to install the Splunk Add-on for Amazon Web Services. Should I install a heavy forwarder just for the AWS add-on? Or can I use Search Head which is not recommended and I'm getting this warning "Configuring this add-on on a search head is not best practice." What is the side effect of using Search Head for AWS add-on?

0 Karma
1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

Hi caglar, thanks for your question.

You can configure this add-on and collect your inputs on your search head, but doing so will impact your search performance. If you collect a very small amount of data with the add-on, this may not be a significant impact for you, but for best results, in a production environment, we strongly recommend that you configure inputs on forwarders, not on search heads.

This add-on requires heavy forwarders rather than universal forwarders because the configurations depend on Python and the setup and authentication are only supported using Splunk Web (neither of which comes with the universal forwarder.)

View solution in original post

rpille_splunk
Splunk Employee
Splunk Employee

Hi caglar, thanks for your question.

You can configure this add-on and collect your inputs on your search head, but doing so will impact your search performance. If you collect a very small amount of data with the add-on, this may not be a significant impact for you, but for best results, in a production environment, we strongly recommend that you configure inputs on forwarders, not on search heads.

This add-on requires heavy forwarders rather than universal forwarders because the configurations depend on Python and the setup and authentication are only supported using Splunk Web (neither of which comes with the universal forwarder.)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...