All Apps and Add-ons

[Protocol Data Inputs] Where to install the add-on ?

SirHill17
Communicator

Hi,

I would like to use the add-on Protocol Data Inputs but I am unsure where should it be installed (meaning if it must be on every indexer part of a cluster --> master server ?) Or install on a dedicated server like Heavy Forwarder.

Thanks for your help.

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Install on a Forwarder.

View solution in original post

0 Karma

Damien_Dallimor
Ultra Champion

Install on a Forwarder.

0 Karma

SirHill17
Communicator

Thanks for your quick answer.
I have another question following your answer. My aim is to have a centralized component masking data for all my servers (+2000) so if I can avoid deploying the add-on on every single host is better and also not impacting the servers where the forwarders run. Do you think it's possible to install the add-on on a Heavy Forwarder and having the UF sending the data to this HF which will handle the data ?

0 Karma

Damien_Dallimor
Ultra Champion

Yes that is possible.
UF -> forward raw TCP -> PDI App's TCP Port running on HF

SirHill17
Communicator

Thanks for your help.

0 Karma

Damien_Dallimor
Ultra Champion

My pleasure , shout out if you need any more help with custom handlers etc.. (I wrote the app).

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...