All Apps and Add-ons

REST API Modular input app and Distributed deployment

be910j
Path Finder

Curious if anyone has found a good way to deal with this issue.

I currently have a distributed deployment with 6 active Indexers. Currently testing the REST API Modular Input app on a single instance test box and its working great but I want to move it over to my prod environment now and put it into our distributed model.
With just the polling model and no cron option (that I saw) is there a way I can keep the data distributed across my multi indexers easily or is it more along the lines of using a single box to make the initial grab/index and forward that data over to my indexer farm for distribution, or maybe setting the polling time on each indexer in such a way that they won't overlap, though Im not sure what kind of combination that would be and would prob grow to be quite complex I would assume?Heavy forwarder and a dedicated API Collection server- VM maybe? Just wandering if there was a preferred method or what people have found success with.

Cheers,
Brandon

1 Solution

be910j
Path Finder

Well just to post a follow up here, while I'm not positive if it's the best way, I ended up building a heavy forwarder to do all the work and send the cooked data over to my indexers, so far seems to be working ok.

-brandon

View solution in original post

Damien_Dallimor
Ultra Champion

There's no distributed co-ordination logic in the REST API Modular Input , so they way you have approached it is probably the best option.

0 Karma

be910j
Path Finder

Well just to post a follow up here, while I'm not positive if it's the best way, I ended up building a heavy forwarder to do all the work and send the cooked data over to my indexers, so far seems to be working ok.

-brandon

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...