I have recently deploy Splunk in a distributed environment with the following elements:
- Management Server (SH Cluster Deployer, Deployment Server, Index Cluster Master)
- Search Head Cluster (3 Search Heads)
- Indexer Cluster (3 Indexers)
The add-on contains elements that should be deployed to the search heads as well as elements that should be deployed to the indexers, however, because some of these configurations also define the inputs, and the input is an API call to Okta API, I want to avoid the scenario where all three indexers are pulling the same data from the Okta API.
Is there any guidance from Okta regarding the best way for this add-on to be deployed in an environment with clustered search heads and indexers?
Should I simply install the add-on on a single search head and indexer rather than use the cluster bundle method? Or perhaps it would be better to utilize a Heavy Forwarder.
Any guidance is greatly appreciated.
