All Apps and Add-ons

[Protocol Data Inputs] Where to install the add-on ?

SirHill17
Communicator

Hi,

I would like to use the add-on Protocol Data Inputs but I am unsure where should it be installed (meaning if it must be on every indexer part of a cluster --> master server ?) Or install on a dedicated server like Heavy Forwarder.

Thanks for your help.

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Install on a Forwarder.

View solution in original post

0 Karma

Damien_Dallimor
Ultra Champion

Install on a Forwarder.

0 Karma

SirHill17
Communicator

Thanks for your quick answer.
I have another question following your answer. My aim is to have a centralized component masking data for all my servers (+2000) so if I can avoid deploying the add-on on every single host is better and also not impacting the servers where the forwarders run. Do you think it's possible to install the add-on on a Heavy Forwarder and having the UF sending the data to this HF which will handle the data ?

0 Karma

Damien_Dallimor
Ultra Champion

Yes that is possible.
UF -> forward raw TCP -> PDI App's TCP Port running on HF

SirHill17
Communicator

Thanks for your help.

0 Karma

Damien_Dallimor
Ultra Champion

My pleasure , shout out if you need any more help with custom handlers etc.. (I wrote the app).

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...