All Apps and Add-ons

REST API Modular input app and Distributed deployment

be910j
Path Finder

Curious if anyone has found a good way to deal with this issue.

I currently have a distributed deployment with 6 active Indexers. Currently testing the REST API Modular Input app on a single instance test box and its working great but I want to move it over to my prod environment now and put it into our distributed model.
With just the polling model and no cron option (that I saw) is there a way I can keep the data distributed across my multi indexers easily or is it more along the lines of using a single box to make the initial grab/index and forward that data over to my indexer farm for distribution, or maybe setting the polling time on each indexer in such a way that they won't overlap, though Im not sure what kind of combination that would be and would prob grow to be quite complex I would assume?Heavy forwarder and a dedicated API Collection server- VM maybe? Just wandering if there was a preferred method or what people have found success with.

Cheers,
Brandon

1 Solution

be910j
Path Finder

Well just to post a follow up here, while I'm not positive if it's the best way, I ended up building a heavy forwarder to do all the work and send the cooked data over to my indexers, so far seems to be working ok.

-brandon

View solution in original post

Damien_Dallimor
Ultra Champion

There's no distributed co-ordination logic in the REST API Modular Input , so they way you have approached it is probably the best option.

0 Karma

be910j
Path Finder

Well just to post a follow up here, while I'm not positive if it's the best way, I ended up building a heavy forwarder to do all the work and send the cooked data over to my indexers, so far seems to be working ok.

-brandon

Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...