Is the Website Monitoring App compatible with SHC?

[atari1050]

Will the Website Monitoring app work with Search Head Clustering? I am testing it in our sandbox SHC and it is successfully pushed out to our SH cluster members, however, when I open it on a member, it doesn't recognize that the Data Input has been configured.

Of course, only the Knowledge Section is available in Settings and i read that Data Inputs are NOT replicated among SHC members. So, I created a local folder under $SPLUNK_HOME/etc/shcluster/apps/website_monitoring/ and placed an inputs.conf file in there and then a cluster push in hopes that the websites would appear in the cluster members. No dice.

Can we hope to have this compatible with SHC sometime soon? Please? 🙂

[atari1050 · Accepted solution]

We ended up installing it on the SHC - all members and it works. However, in order to view and add data, click the 'View All' button when the warning appears. Adding in a website will then replicate to all members without a need for an SHC bundle deployment.

[vkumar2016]

Hi atari1050. I am having similar issues while trying to deploy the app in the SHC env. Can u pls provide details on how you installed the app in the Cluster env?

[gwobben]

Try this:
Install the data inputs on a forwarder (or maybe indexer if you have to...). Make sure it's just one machine.

Next:
Push the dashboards, savedsearches, etc. (usually located in a different app) to the SHC.

Finally:
Make sure your SHC can search the indexer that contains the data. (http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCandindexercluster)

Data will be collected only once and saved in indexes. Your SHC will search the indexes and each member will return the correct data.

[atari1050]

Unfortunately, gwobben, I do not think this is an answer I can live with, although I appreciate it.

Having to break up the application components (yes, I know, these are conf files) is not a great way to ensure compatibility.

If I go forward with your suggestion, you are talking about a Relay Forwarder to house the Data Inputs?

That makes sense if we are dependent on the RF to forward the data. Won't be able to use the GUI in the future to add new websites, however, which is a nice feature. Reason for this is RF's usually do not have Splunkweb enabled (not a good idea to do so).

The dashboards are packaged with the Website_Monitoring app.

I think I might have to install this on an app server and keep it out of the cluster, but make sure the app server forwards to the RF's, which will then propagate.

I will let everyone know if this works; if anyone is interested.

[atari1050]

I forgot to mention to anyone not totally familiar with SHC: You do NOT have access to the Data section on a cluster member. If you do expand the view to show all, you get a warning that this will NOT be replicated.